InternationalColorConsortium vulnerabilities and threats

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have a Heap-based Buffer Overflow in its CIccMBB::Validate function which checks tag data validity. This issue is fixed in version 2.3.1.1.

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a memory leak vulnerability in its XML MPE Parsing Path (iccFromXml). This issue is fixed in version 2.3.1.1.

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have overflows and underflows in CIccXmlArrayType::ParseTextCountNum(). This vulnerability affects users of the iccDEV library who process ICC color profiles. This issue is fixed in version 2.3.1.1.

CVE-2026-21507 is a high-severity vulnerability in iccDEV versions prior to 2.3.1.1, caused by an infinite loop in the CalcProfileID function of IccProfile.cpp. This infinite loop results from an unreachable exit condition, leading to denial of service by exhausting CPU resources. The vulnerability does not impact confidentiality or integrity but severely affects availability. It requires no authentication or user interaction and can be exploited remotely via crafted ICC color profiles. European organizations using iccDEV for color management in imaging, printing, or graphic design software are at risk of service disruption. The issue is fixed in version 2.