CVE-2026-21683: color iccdev Improper Input Validation
Vulnerability summary
CVE-2026-21683 is a high (CVSS 8.8) Improper Input Validation vulnerability in color iccdev. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.4% of scored vulnerabilities.
Timeline
- 07-01-2026PublishedVulnerability first disclosed.
- 07-01-2026Last modifiedVulnerability information updated.
Description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `icStatusCMM::CIccEvalCompare::EvaluateProfile()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
+0.01 pp
From 0.31% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Affected systems
2 vendors · 2 products
References
3 links- github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-f2wp-j3fr-938wX Refsource CONFIRMPatchVendor Advisory