CVE-2026-21504

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-21504

6.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

i

ccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap buffer overflow in the ToneMap parser. This issue has been patched in version 2.3.1.2.

References
Link Resource
https://github.com/InternationalColorConsortium/iccDEV/blob/798be59011649a26a529600cc3cd56437634d3d0/IccProfLib/IccMpeBasic.cpp#L4557 Product
https://github.com/InternationalColorConsortium/iccDEV/commit/14fe3785e6b1f9992375b2a24617a0d7f6a70f95 Patch
https://github.com/InternationalColorConsortium/iccDEV/commit/23a38f83f2a5874a1c4427df59ec342af3277cad Patch
https://github.com/InternationalColorConsortium/iccDEV/issues/366 Exploit Issue Tracking
https://github.com/InternationalColorConsortium/iccDEV/pull/415 Issue Tracking
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-rqp9-r53c-3m9h Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
History

09 Jan 2026, 21:34

Type Values Removed Values Added
First Time Color
Color iccdev
CPE cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
References () https://github.com/InternationalColorConsortium/iccDEV/blob/798be59011649a26a529600cc3cd56437634d3d0/IccProfLib/IccMpeBasic.cpp#L4557 - () https://github.com/InternationalColorConsortium/iccDEV/blob/798be59011649a26a529600cc3cd56437634d3d0/IccProfLib/IccMpeBasic.cpp#L4557 - Product
References () https://github.com/InternationalColorConsortium/iccDEV/commit/14fe3785e6b1f9992375b2a24617a0d7f6a70f95 - () https://github.com/InternationalColorConsortium/iccDEV/commit/14fe3785e6b1f9992375b2a24617a0d7f6a70f95 - Patch
References () https://github.com/InternationalColorConsortium/iccDEV/commit/23a38f83f2a5874a1c4427df59ec342af3277cad - () https://github.com/InternationalColorConsortium/iccDEV/commit/23a38f83f2a5874a1c4427df59ec342af3277cad - Patch
References () https://github.com/InternationalColorConsortium/iccDEV/issues/366 - () https://github.com/InternationalColorConsortium/iccDEV/issues/366 - Exploit, Issue Tracking
References () https://github.com/InternationalColorConsortium/iccDEV/pull/415 - () https://github.com/InternationalColorConsortium/iccDEV/pull/415 - Issue Tracking
References () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-rqp9-r53c-3m9h - () https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-rqp9-r53c-3m9h - Third Party Advisory

07 Jan 2026, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-07 18:15

Updated : 2026-01-09 21:34

NVD link : CVE-2026-21504

Mitre link : CVE-2026-21504

CVE.ORG link : CVE-2026-21504

JSON object : View

Products Affected

color

CWE
CWE-122

Heap-based Buffer Overflow

CWE-193

Off-by-one Error

CWE-787

Out-of-bounds Write