CVE-2026-21679: high-severity vulnerability in InternationalColorConsortium iccDEV
iccDEV has heap-buffer-overflow vulnerability in CIccLocalizedUnicode::GetText()
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
iccDEV, a color management library, has a heap buffer overflow vulnerability in its text handling function. An attacker could provide specially crafted input to cause a program crash or potentially execute malicious code.
CIccLocalizedUnicode::GetText() contains a heap buffer overflow due to improper input validation (CWE-20). An attacker can trigger this via malformed localized unicode text data in ICC profiles, potentially achieving code execution or denial of service. The vulnerability is fixed in version 2.3.1.2 and later.
In the same product, most dangerous first.