CVE-2026-21505: color iccdev Improper Input Validation

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

+0.01 pp

From 0.19% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

githubUnverified
Iccdev
Maturity: poc

References

5 links

github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-j577-8285-qrf9X Refsource CONFIRMThird Party Advisory
github.com/InternationalColorConsortium/iccDEV/issues/361X Refsource MISCExploitIssue Tracking
github.com/InternationalColorConsortium/iccDEV/pull/419X Refsource MISCIssue Tracking
github.com/InternationalColorConsortium/iccDEV/commit/3bbe2088b2796cf0aa4f7fa19f7ccd9ad1c7aba5X Refsource MISCPatch
github.com/InternationalColorConsortium/iccDEV/commit/b1bb72fc3e9442ee1355aabae7314bb7d3fc9d41X Refsource MISCPatch

Related vulnerabilities

CVE-2026-21502coloriccdev+10.19%9mo ago07-01-2026 17:09iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the XML tag parser. This issue has been patched in version 2.3.1.2.CVE-2026-21487coloriccdev+10.19%9mo ago06-01-2026 03:27iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have an Out-of-bounds Read, Use of Out-of-range Pointer Offset and have Improper Input Validation in its CIccProfile::LoadTag function. This issue is fixed in version 2.3.1.2.CVE-2026-21688coloriccdev+10.37%9mo ago07-01-2026 21:43iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `SIccCalcOp::ArgsPushed()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.CVE-2026-21493coloriccdev+10.19%9mo ago06-01-2026 14:11iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3.1.2.CVE-2026-21685coloriccdev+10.29%9mo ago07-01-2026 21:23iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagLut16::Read()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.CVE-2026-21506coloriccdev+10.19%9mo ago07-01-2026 17:10iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to Null pointer dereference in CIccProfileXml::ParseBasic(), leading to denial of service. This issue has been patched in version 2.3.1.2.

All vulnerabilities iniccdev iccdev

CVE-2026-21505: color iccdev Improper Input Validation

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References