CVE-2026-21688
Published: 07 January 2026
Description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `SIccCalcOp::ArgsPushed()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects…
more
users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely patching of known flaws, such as updating iccDEV to version 2.3.1.2 to remediate the type confusion vulnerability.
Requires validation of inputs like ICC profiles to prevent exploitation via malformed data causing type confusion, addressing associated CWE-20.
Implements memory protections such as address space layout randomization and non-executable stacks to mitigate exploitation of type confusion leading to code execution.
Security SummaryAI
CVE-2026-21688 is a Type Confusion vulnerability in the iccDEV library, located in the `SIccCalcOp::ArgsPushed()` function at `IccProfLib/IccMpeCalc.cpp`. The iccDEV library offers tools and libraries for interacting with, manipulating, and applying International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 are affected, impacting any users or applications that process ICC color profiles with the library. The vulnerability was published on 2026-01-07 and is associated with CWEs-20 (Improper Input Validation), CWE-190 (Integer Overflow or Wraparound), CWE-476 (NULL Pointer Dereference), and CWE-681 (Incorrect Conversion between Numeric Types).
Attackers can exploit this vulnerability remotely (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), such as tricking a user into processing a malicious ICC profile. The unchanged scope (S:U) and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) yield a CVSS v3.1 base score of 8.8, potentially enabling arbitrary code execution or system compromise on affected systems.
The issue is addressed in iccDEV version 2.3.1.2, which contains the patch. No known workarounds exist. Details are available in the GitHub security advisory at GHSA-3r2x-j7v3-pg6f, issue #379, and pull request #422 in the InternationalColorConsortium/iccDEV repository.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Type confusion vulnerability in ICC color profile library enables arbitrary code execution via exploitation of client applications processing malicious ICC profiles, directly mapping to Exploitation for Client Execution.