CVE-2026-21685: color iccdev Improper Input Validation
Vulnerability summary
CVE-2026-21685 is a high (CVSS 7.1) Improper Input Validation vulnerability in color iccdev. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 07-01-2026PublishedVulnerability first disclosed.
- 07-01-2026Last modifiedVulnerability information updated.
Description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagLut16::Read()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
+0.01 pp
From 0.28% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundIccdev
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-758Reliance on Undefined, Unspecified, or Implementation-Defined BehaviorThe product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.
Affected systems
2 vendors · 2 products
References
3 links- github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-c3xr-6687-5c8pX Refsource CONFIRMVendor Advisory
- github.com/InternationalColorConsortium/iccDEV/issues/213X Refsource MISCExploitIssue TrackingVendor Advisory