CVE-2026-21507 – CVE-2026-21507 is an infinite loop vulnerabilit... (How to Fix)

Q: What is the severity of CVE-2026-21507?

CVE-2026-21507 has a CVSS score of 7.5 (HIGH). CVE-2026-21507 is an infinite loop vulnerability in the CalcProfileID function of iccDEV's IccProfile.cpp. This allows attackers to cause denial of service by triggering resource exhaustion. Users of iccDEV libraries and tools are affected.

📋 TL;DR

CVE-2026-21507 is an infinite loop vulnerability in the CalcProfileID function of iccDEV's IccProfile.cpp. This allows attackers to cause denial of service by triggering resource exhaustion. Users of iccDEV libraries and tools are affected.

💻 Affected Systems

Products:

iccDEV libraries and tools

Versions: 2.3.1 and below

Operating Systems: All platforms running iccDEV

Default Config Vulnerable: ⚠️ Yes

Notes: Any application using iccDEV to process ICC color profiles is vulnerable

📦 What is this software?

Iccdev by Color

View all CVEs affecting Iccdev →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system unavailability due to CPU exhaustion, potentially affecting all applications using iccDEV libraries

🟠

Likely Case

Application crashes or hangs when processing malicious ICC profiles, causing service disruption

🟢

If Mitigated

Minimal impact with proper input validation and resource limits in place

🌐 Internet-Facing: MEDIUM - Exploitable if applications process untrusted ICC profiles from external sources

🏢 Internal Only: LOW - Requires processing of malicious ICC profiles, less likely in controlled environments

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires providing a malicious ICC profile to vulnerable applications

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.3.1.1

Vendor Advisory: https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-hgp5-r8m9-8qpj

Restart Required: Yes

Instructions:

1. Update iccDEV to version 2.3.1.1 or later. 2. Rebuild any applications using iccDEV libraries. 3. Restart affected services.

🔧 Temporary Workarounds

Input validation for ICC profiles

all

Implement strict validation of ICC profile inputs before processing

Resource limiting

linux

Set CPU time limits for processes handling ICC profiles

ulimit -t 30 # Linux example to limit CPU time

🧯 If You Can't Patch

Implement strict input validation for all ICC profile processing
Isolate ICC profile processing in containers with resource limits

🔍 How to Verify

Check if Vulnerable:

Check iccDEV version: if version ≤ 2.3.1, system is vulnerable

Check Version:

iccdev-config --version or check library version in application

Verify Fix Applied:

Confirm iccDEV version is ≥ 2.3.1.1 and test with known ICC profiles

📡 Detection & Monitoring

Log Indicators:

Processes consuming 100% CPU for extended periods
Application crashes when processing ICC profiles

Network Indicators:

Unusual ICC profile uploads to applications

SIEM Query:

Process:CPU_Usage > 95% AND Process_Name contains 'icc' OR 'color'

📊 Metadata

CVE ID: CVE-2026-21507

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-835

EPSS Score: 0.05% exploit probability (15.4th percentile)

Published: January 6, 2026

Last Updated: January 12, 2026

🔗 References

https://github.com/InternationalColorConsortium/iccDEV/commit/3f3ce789d0d2b608c194ed172fa38943519dc198 Patch
https://github.com/InternationalColorConsortium/iccDEV/issues/244 Issue Tracking,Exploit,Vendor Advisory
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-hgp5-r8m9-8qpj Patch,Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2026-21507, you might also want to check these: