CVE-2026-21506

MEDIUM

iccDEV < 2.3.1.2 - Denial of Service via Null Pointer Dereference in CIccProfileXml::ParseBasic()

Title source: llm

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to Null pointer dereference in CIccProfileXml::ParseBasic(), leading to denial of service. This issue has been patched in version 2.3.1.2.

References (4)

Core 4

Core References

Third Party Advisory x_refsource_confirm

https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-wfm7-m548-x4vp

Exploit, Issue Tracking x_refsource_misc

https://github.com/InternationalColorConsortium/iccDEV/issues/371

Issue Tracking x_refsource_misc

https://github.com/InternationalColorConsortium/iccDEV/pull/418

Patch x_refsource_misc

https://github.com/InternationalColorConsortium/iccDEV/commit/f2ea32372ad3ebbd29147940229cb9c5548fe033

View Patch ZIP pw:eip

Scores

CVSS v3 5.5

EPSS 0.0015

EPSS Percentile 5.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-20 CWE-476

Status published

Products (1)

color/iccdev < 2.3.1.2

Published Jan 07, 2026

Tracked Since Feb 18, 2026