CVE-2026-21686CWE-20CWE-758

iccDEV has Undefined Behavior in CIccTagLutAtoB::Validate()

High · published January 7, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

⚡ An undefined behavior bug in `CIccTagLutAtoB::Validate()` is like a color artist accidentally mixing paint without knowing what shade will come out—totally unpredictable! 🎨 Think of it like a bakery where the recipes are supposed to produce consistent bread. If one recipe has an undefined ingredient, every loaf baked could turn out completely different, leading to disastrous results! This vulnerability could allow incorrect processing of ICC color profiles, leading to unexpected behavior in applications that rely on accurate color management. The consequences might not only affect visual output but could also result in crashes or erratic application behavior, leaving users in a sticky situation. 😱

Put simply

Think of it like a bakery where the recipes are supposed to produce consistent bread. If one recipe has an undefined ingredient, every loaf baked could turn out completely different, leading to disastrous results! The flaw in versions prior to 2.3.1.2 of the iccDEV library allows for undefined behavior when validating ICC color profiles, potentially affecting how colors are represented and processed in applications.

What to do

This vulnerability could allow incorrect processing of ICC color profiles, leading to unexpected behavior in applications that rely on accurate color management. The consequences might not only affect visual output but could also result in crashes or erratic application behavior, leaving users in a sticky situation. 😱 Upgrade to version 2.3.1.2 immediately to patch this vulnerability. Since no workarounds are available, ensure that all users of the library are updated to this version as soon as possible. 🛡️ You've got this! With a quick update, you’ll be back to confidently handling colors like a pro! 🎉

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00293 · 20.7th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-758 · Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Published
2026-01-07T21:25Z
EPSS history
Timeline
  • 07 JAN 21:25Z
    iccDEV has Undefined Behavior in CIccTagLutAtoB::Validate()
    cvelistv5