CVE-2026-21676: high-severity vulnerability in InternationalColorConsortium iccDEV
iccDEV has a Heap-based Buffer Overflow in its CIccMBB::Validate() function
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
iccDEV, a tool for color management profiles, has a flaw in how it checks profile data that allows attackers to overflow memory and crash the program or execute malicious code. This affects versions 2.3.1 and earlier.
A heap-based buffer overflow exists in the CIccMBB::Validate() function that processes ICC color profile tag data. An attacker can supply a specially crafted profile file to trigger the overflow during validation, potentially achieving code execution or denial of service. The vulnerability is resolved in version 2.3.1.1.
In the same product, most dangerous first.