CVE-2026-21494: color iccdev Heap-based Buffer Overflow

Vulnerability summary

CVE-2026-21494 is a high (CVSS 7.1) Heap-based Buffer Overflow vulnerability in color iccdev. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.2% of scored vulnerabilities.

Timeline

1. 06-01-2026
   PublishedVulnerability first disclosed.
2. 06-01-2026
   Last modifiedVulnerability information updated.

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV library who process ICC color profiles. It results in heap buffer overflow in `CIccTagLut8::Validate()`. Version 2.3.1.2 contains a patch. No known workarounds are available.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-193Off-by-one ErrorA product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.