CVE-2026-21489
Out-of-Bounds Read and Integer Underflow in iccDEV Library
Publication date: 2026-01-06
Last updated on: 2026-01-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| internationalcolorconsortium | iccdev | to 2.3.1.1 (exc) |
| internationalcolorconsortium | iccdev | From 2.3.1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in iccDEV involves an out-of-bounds read and an integer underflow in the function CIccCalculatorFunc::SequenceNeedTempReset. Specifically, unsafe subtraction operations on indices or offsets in sequences of operations can cause integer underflow, leading to invalid memory access or logic errors. The issue arises when calculated indices exceed the number of operations, and without proper bounds checking, this results in reading beyond buffer limits or wraparound of integer values. The vulnerability was fixed by adding explicit boundary checks before performing these operations to prevent underflow and out-of-bounds access. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to reading memory outside of intended boundaries and integer underflow, which may cause application crashes or denial of service, impacting availability. The CVSS score indicates a high impact on availability, with low confidentiality impact and no integrity impact. An attacker with local access and requiring user interaction could exploit this to disrupt the normal functioning of applications using iccDEV, potentially causing them to crash or behave unpredictably. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the iccDEV library to version 2.3.1.2 or later, where the issue has been fixed. There are no known workarounds, so applying the patch or updating to the fixed version is necessary to prevent exploitation. [2]