CVE-2026-21675

CVE-2026-21675 is a Use After Free vulnerability (CWE-416, CWE-20) affecting iccDEV, a set of libraries and tools for working with ICC color management profiles. The flaw resides in the CIccXform::Create() function, where an object referred to as the "hint" is deleted, leading to potential memory corruption in affected versions 2.3.1 and earlier. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.

Remote attackers require no privileges or user interaction to exploit this issue over the network with low attack complexity. Successful exploitation could allow arbitrary code execution, data disclosure, or system compromise by triggering the Use After Free during color profile processing, potentially in applications or systems that parse untrusted ICC profiles.

Mitigation is available via an upgrade to iccDEV version 2.3.1.1, which addresses the issue as detailed in the project's GitHub security advisory (GHSA-wcwx-794g-g78f), related issues (#182), and the fixing commit (510baf58fa48e00ebbb5dd577f0db4af8876bb31). Security practitioners should audit dependencies on iccDEV and ensure parsing of untrusted ICC files is sandboxed or disabled where possible.