CVE-2026-21497
📋 TL;DR
A NULL pointer dereference vulnerability in iccDEV's unknown tag parser allows attackers to cause denial of service by crashing applications using the library. This affects all systems running iccDEV versions before 2.3.1.2 that process untrusted ICC color profiles.
💻 Affected Systems
- iccDEV library and tools
📦 What is this software?
Iccdev by Color
⚠️ Risk & Real-World Impact
Worst Case
Application crash leading to denial of service, potentially disrupting color-critical workflows in design, printing, or imaging applications.
Likely Case
Application instability or crash when processing malformed ICC color profiles, requiring restart of affected software.
If Mitigated
Minimal impact with proper input validation and error handling in calling applications.
🎯 Exploit Status
Exploitation requires providing a malicious ICC profile to vulnerable software, but no public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.1.2
Vendor Advisory: https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-7gv7-cmrv-4j85
Restart Required: Yes
Instructions:
1. Update iccDEV to version 2.3.1.2 or later. 2. Rebuild any applications linked against iccDEV. 3. Restart services using the updated library.
🔧 Temporary Workarounds
Input validation
allImplement strict validation of ICC profile inputs before processing
Sandbox processing
allIsolate ICC profile processing in separate containers or sandboxes
🧯 If You Can't Patch
- Restrict processing of untrusted ICC profiles to minimize attack surface
- Implement monitoring for application crashes related to ICC profile processing
🔍 How to Verify
Check if Vulnerable:
Check iccDEV version using 'iccdev --version' or examine linked library version in applicationsCheck Version:
iccdev --versionVerify Fix Applied:
Confirm version is 2.3.1.2 or later and test with known ICC profile processing📡 Detection & Monitoring
Log Indicators:
- Application crashes during ICC profile processing
- Segmentation faults in iccDEV-related processes
Network Indicators:
- Unusual ICC profile uploads to web applications
- Multiple failed ICC processing attempts
SIEM Query:
source="application.log" AND ("segmentation fault" OR "null pointer") AND "icc"🔗 References
- https://github.com/InternationalColorConsortium/iccDEV/commit/9419cac7f084197941994b8b9d17def204008385
- https://github.com/InternationalColorConsortium/iccDEV/issues/374
- https://github.com/InternationalColorConsortium/iccDEV/pull/403
- https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-7gv7-cmrv-4j85
