CVE-2026-21493: color iccdev Reliance on Data/Memory Layout

Vulnerability summary

CVE-2026-21493 is a medium (CVSS 6.6) Reliance on Data/Memory Layout vulnerability in color iccdev. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-01-2026
   PublishedVulnerability first disclosed.
2. 06-01-2026
   Last modifiedVulnerability information updated.

Description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3.1.2.

• CWE-188Reliance on Data/Memory LayoutThe product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.
• CWE-703Improper Check or Handling of Exceptional ConditionsThe product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
• CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.