Vulnerability · Published Jan 6, 2026 · Assigned by GitHub_M
CVE-2026-21676iccDEV has a Heap-based Buffer Overflow in its CIccMBB::Validate() function
High 8.8
In plain English
A high-severity heap buffer overflow in iccDEV from InternationalColorConsortium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 64.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have a Heap-based Buffer Overflow in its CIccMBB::Validate function which checks tag data validity. This issue is fixed in version 2.3.1.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| InternationalColorConsortium | iccDEV | < 2.3.1.1 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-j5vv-p2hv-c392 x_refsource_CONFIRM
- https://github.com/InternationalColorConsortium/iccDEV/issues/215 x_refsource_MISC
- https://github.com/InternationalColorConsortium/iccDEV/commit/e4c38a67d06073b38d58580b0cfc78ca61005f84 x_refsource_MISC