CVE-2026-21506
Null Pointer Dereference in iccDEV ICC Profile Parsing Causes DoS
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| internationalcolorconsortium | iccdev | to 2.3.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a null pointer dereference in the function CIccProfileXml::ParseBasic() of the iccDEV library. It occurs when the code attempts to access the 'children' member of an XML node without checking if it is null. Specifically, when parsing ICC profile XML data, if certain XML elements like 'ProfileVersion' or 'ProfileSubClassVersion' lack child nodes, the code dereferences a null pointer, causing a crash or denial of service. The issue was fixed by adding checks to ensure the 'children' pointer is not null before accessing its content. [1, 3, 4]
How can this vulnerability impact me? :
This vulnerability can cause a denial of service (DoS) condition by crashing the application that uses the iccDEV library to parse ICC profile XML data. An attacker with local access can exploit this by providing maliciously crafted ICC profiles that trigger the null pointer dereference, leading to application crashes or abnormal termination. The impact affects availability but does not compromise confidentiality or integrity. [2, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the iccDEV tool (specifically iccFromXml) with crafted ICC profile XML files that contain empty or malformed elements such as missing child nodes for "ProfileVersion" or "ProfileSubClassVersion". A crash or segmentation fault (SEGV) during parsing indicates the presence of the vulnerability. Using debugging tools like AddressSanitizer can help detect invalid memory access at the source code location CIccProfileXml::ParseBasic(). There are no specific network detection commands since the attack vector is local and requires user interaction. To test, you can run iccFromXml with a crafted XML file that triggers the null pointer dereference, for example: `iccFromXml malformed_profile.xml` and observe if the application crashes. [4]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade iccDEV to version 2.3.1.2 or later, where the vulnerability has been patched by adding null pointer checks in the CIccProfileXml::ParseBasic() function. Until the upgrade, avoid processing untrusted or malformed ICC profile XML files with vulnerable versions of iccDEV to prevent denial of service. No workarounds are provided. [2, 1]