Vulnerability · Published Jan 7, 2026 · Assigned by GitHub_M
CVE-2026-21504Heap Buffer Overflow in iccDEV ToneMap Parser
Medium 6.6
In plain English
A medium-severity heap buffer overflow in iccDEV from InternationalColorConsortium. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.2%top 87.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap buffer overflow in the ToneMap parser. This issue has been patched in version 2.3.1.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| InternationalColorConsortium | iccDEV | < 2.3.1.2 |
Weakness: CWE-122, CWE-193, CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
References
- https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-rqp9-r53c-3m9h x_refsource_CONFIRM
- https://github.com/InternationalColorConsortium/iccDEV/issues/366 x_refsource_MISC
- https://github.com/InternationalColorConsortium/iccDEV/pull/415 x_refsource_MISC
- https://github.com/InternationalColorConsortium/iccDEV/commit/14fe3785e6b1f9992375b2a24617a0d7f6a70f95 x_refsource_MISC
- https://github.com/InternationalColorConsortium/iccDEV/commit/23a38f83f2a5874a1c4427df59ec342af3277cad x_refsource_MISC
- https://github.com/InternationalColorConsortium/iccDEV/blob/798be59011649a26a529600cc3cd56437634d3d0/IccProfLib/IccMpeBasic.cpp#L4557 x_refsource_MISC