CVE-2026-21677

Description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have Undefined Behavior in its CIccCLUT::Init function which initializes and sets the size of a CLUT. This issue is fixed in version 2.3.1.1.

PUBLISHED Reserved 2026-01-02 | Published 2026-01-06 | Updated 2026-01-06 | Assigner GitHub_M

Problem types

CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CWE-20: Improper Input Validation

Product status

References

github.com/InternationalColorConsortium/iccDEV/issues/181 exploit

github.com/...iccDEV/security/advisories/GHSA-95w5-jvqf-3994

github.com/InternationalColorConsortium/iccDEV/issues/181

github.com/...ommit/201125fbda22c8e4ea95800a6b427093fa4b8a22

cve.org (CVE-2026-21677)

nvd.nist.gov (CVE-2026-21677)

Download JSON