CVE-2026-21682
Published: 07 January 2026
Description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow in `CIccXmlArrayType::ParseText()`. This vulnerability affects users of the iccDEV…
more
library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely flaw remediation through patching to iccDEV 2.3.1.2, eliminating the heap-buffer-overflow vulnerability.
Requires validation of inputs to ICC profiles processed by CIccXmlArrayType::ParseText(), addressing the core CWE-20 improper input validation causing the buffer overflow.
Implements memory protections such as heap isolation, randomization, and non-executable regions to mitigate exploitation of the heap-buffer-overflow.
Security SummaryAI
CVE-2026-21682 is a heap-buffer-overflow vulnerability in the `CIccXmlArrayType::ParseText()` function within the iccDEV library, a set of libraries and tools for interacting with, manipulating, and applying International Color Consortium (ICC) color management profiles. The flaw affects versions of iccDEV prior to 2.3.1.2 and impacts users or applications that process ICC color profiles using the library. It is classified under CWE-20 (Improper Input Validation) and CWE-122 (Heap-based Buffer Overflow), with a CVSS v3.1 base score of 8.8.
Attackers can exploit this vulnerability remotely over the network with low complexity and no required privileges, but it requires user interaction, such as tricking a victim into processing a malicious ICC profile. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, potentially allowing arbitrary code execution, data corruption, or denial of service on the affected system.
The official mitigation is to upgrade to iccDEV version 2.3.1.2, which includes a patch for the vulnerability. No known workarounds are available. Relevant advisories and fixes are detailed in the project's GitHub security advisory (GHSA-jq9m-54gr-c56c), issue tracker (#178), and pull request (#229).
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow enables arbitrary code execution via exploitation of client applications processing malicious ICC profiles, directly mapping to T1203 (Exploitation for Client Execution).