CVE-2026-21684CWE-20CWE-758

iccDEV has Undefined Behavior in CIccTagSpectralViewingConditions()

High · published January 7, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

⚡ Attention, color enthusiasts! A sneaky flaw in iccDEV's `CIccTagSpectralViewingConditions()` could lead to undefined behavior in your color profiles! 🎨 Think of it like a color palette that spills everywhere, creating a chaotic mess rather than the beautiful artwork you intended. Without the right control, you could end up with an unexpected splash of colors ruining your masterpiece! This vulnerability can lead to unpredictable results when processing ICC color profiles, potentially causing applications to crash or behave erratically. In a worst-case scenario, it could compromise visual integrity in applications heavily reliant on accurate color representation, like graphic design or printing services!

Put simply

Think of it like a color palette that spills everywhere, creating a chaotic mess rather than the beautiful artwork you intended. Without the right control, you could end up with an unexpected splash of colors ruining your masterpiece! The issue arises from undefined behavior within the `CIccTagSpectralViewingConditions()` function in iccDEV versions prior to 2.3.1.2, which processes ICC color management profiles. This can lead to crashes or unpredictable behaviors when manipulating color data.

What to do

This vulnerability can lead to unpredictable results when processing ICC color profiles, potentially causing applications to crash or behave erratically. In a worst-case scenario, it could compromise visual integrity in applications heavily reliant on accurate color representation, like graphic design or printing services! Update to iccDEV version 2.3.1.2 immediately to patch this vulnerability. As there's no known workaround, ensure all your projects using this library are updated to the latest version to maintain stability and accuracy in color processing. You've got this! Follow these steps, and you'll have your color operations back on track in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00293 · 20.7th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-758 · Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Published
2026-01-07T21:18Z
EPSS history
Timeline
  • 07 JAN 21:18Z
    iccDEV has Undefined Behavior in CIccTagSpectralViewingConditions()
    cvelistv5