CVE-2026-21675
Use After Free in iccDEV CIccXform::Create() Causes Crash
Publication date: 2026-01-06
Last updated on: 2026-01-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| internationalcolorconsortium | iccdev | to 2.3.1.2 (exc) |
| internationalcolorconsortium | iccdev | to 2.3.1.2 (inc) |
| internationalcolorconsortium | iccdev | to 2.3.1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized access, modification, and disruption of data due to its high impact on confidentiality, integrity, and availability. This could lead to non-compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and system availability. However, specific compliance impacts are not detailed in the provided resources. [3]
Can you explain this vulnerability to me?
CVE-2026-21675 is a Use After Free vulnerability in the iccDEV library, specifically in the CIccXform::Create() function. The issue occurs because a hint object (pNamedColorHint) is added to a hint manager which takes ownership of it, but the code then manually deletes this hint, leading to a situation where the program accesses memory that has already been freed. This can cause memory corruption or crashes. The vulnerability affects versions 2.3.1 and below and is fixed in version 2.3.1.1 and later. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized data access, unauthorized data modification, and service disruption. Because it is a Use After Free bug, it can lead to memory corruption or crashes, potentially allowing remote attackers to exploit the system without any privileges or user interaction. The CVSS score is 9.8, indicating critical severity with high impact on confidentiality, integrity, and availability. [3]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade the iccDEV library to version 2.3.1.2 or later, where the Use After Free issue in the CIccXform::Create() function has been fixed. Avoid using versions 2.3.1 and below. No workarounds are provided, so updating is the primary mitigation step. [3]