CVE-2026-21675
📋 TL;DR
CVE-2026-21675 is a use-after-free vulnerability in iccDEV's CIccXform::Create() function that can lead to arbitrary code execution. This affects applications using iccDEV libraries for ICC color profile processing. Attackers could exploit this to compromise systems processing malicious color profiles.
💻 Affected Systems
- iccDEV library
- Applications using iccDEV for ICC color management
📦 What is this software?
Iccdev by Color
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crashes (denial of service) or limited code execution within the application context.
If Mitigated
Application crash without code execution if memory protections like ASLR are effective.
🎯 Exploit Status
Exploitation requires crafting a malicious ICC profile, but use-after-free vulnerabilities are commonly weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.1.1
Vendor Advisory: https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-wcwx-794g-g78f
Restart Required: Yes
Instructions:
1. Update iccDEV to version 2.3.1.1 or later. 2. Recompile applications using iccDEV. 3. Restart affected services.
🔧 Temporary Workarounds
Disable ICC profile processing
allTemporarily disable color profile processing in applications if not essential
Input validation
allImplement strict validation of ICC profile files before processing
🧯 If You Can't Patch
- Isolate systems using iccDEV behind network segmentation
- Implement application allowlisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check linked libraries for iccDEV version ≤2.3.1 using ldd/otool/dependency walkerCheck Version:
pkg-config --modversion iccdev (Linux) or check library version infoVerify Fix Applied:
Verify iccDEV version is ≥2.3.1.1 and applications have been recompiled📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected process termination when processing color profiles
Network Indicators:
- Unusual outbound connections from color management applications
SIEM Query:
Process: (name contains 'color' OR 'icc') AND EventID: 1000 (Application Crash)🔗 References
- https://github.com/InternationalColorConsortium/iccDEV/commit/510baf58fa48e00ebbb5dd577f0db4af8876bb31
- https://github.com/InternationalColorConsortium/iccDEV/issues/182
- https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-wcwx-794g-g78f
- https://github.com/InternationalColorConsortium/iccDEV/issues/182
