CVE-2026-21485

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (UB) and Out of Memory errors. This issue is fixed in version 2.3.1.2.

Scoring

Severity

HIGH

CVSS base score

8.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS probability

0.36%

CWE

CWE-20, CWE-125, CWE-190, CWE-400, CWE-476, CWE-787, CWE-1284

Published

2026-01-06

Last modified

2026-03-12

Affected products

• InternationalColorConsortium iccDEV

Weakness type

• CWE-20
• CWE-125
• CWE-190
• CWE-400
• CWE-476
• CWE-787
• CWE-1284

Related vulnerabilities

• CVE-2026-54694 — NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
• CVE-2026-86768 — Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
• CVE-2025-71417 — PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket
• CVE-2024-58380 — PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket
• CVE-2023-54393 — PocketMine-MP before 4.20.5 Denial of Service via LoginPacket
• CVE-2023-54392 — PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket
• CVE-2026-74761 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
• CVE-2026-73334 — Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Markdown version · Browse all CVEs