CVE-2026-21675

The vulnerability lies in the fact that the CIccXform::Create() function deallocates (frees) the hint object, after which it is possible to reference the already freed memory area (use-after-free). This is a classic memory management error classified as CWE-416. An attacker can provide a crafted ICC profile that calls this function in a way that allows control over the freed memory area.

Successful exploitation of this vulnerability may lead to arbitrary code execution (RCE) in the context of an application using the library, as well as disclosure of sensitive data or system instability (denial of service). The full CVSS vector indicates the possibility of violations of confidentiality, integrity, and availability.

iccDEV should be updated to version 2.3.1.1, in which the issue has been fixed. The patch is available in the project repository on GitHub (commit 510baf58fa48e00ebbb5dd577f0db4af8876bb31).

iccDEV in versions 2.3.1 and earlier (libraries and tools for handling ICC profiles compliant with the International Color Consortium standard).