CVE-2026-21503

MEDIUM

iccDEV < 2.3.1.2 - Denial of Service via Null Pointer in CIccTagSparseMatrixArray

Title source: llm

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV has undefined behavior due to a null pointer passed to memcpy() in CIccTagSparseMatrixArray. This issue has been patched in version 2.3.1.2.

References (4)

Core 4

Core References

Third Party Advisory x_refsource_confirm

https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-h554-qrfh-53gx

Exploit, Issue Tracking x_refsource_misc

https://github.com/InternationalColorConsortium/iccDEV/issues/367

Issue Tracking x_refsource_misc

https://github.com/InternationalColorConsortium/iccDEV/pull/417

Patch x_refsource_misc

https://github.com/InternationalColorConsortium/iccDEV/commit/55259a6395c4f6124b5d0e38469c77412926bd3d

View Patch ZIP pw:eip

Scores

CVSS v3 6.1

EPSS 0.0015

EPSS Percentile 4.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-131 CWE-20 CWE-476 CWE-628

Status published

Products (1)

color/iccdev < 2.3.1.2

Published Jan 07, 2026

Tracked Since Feb 18, 2026