CVE-2026-21675
Unknown Unknown - Not Provided

Use After Free in iccDEV CIccXform::Create() Causes Crash

Publication date: 2026-01-06

Last updated on: 2026-01-06

Assigner: GitHub, Inc.

Description
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-01-06
Last Modified
2026-01-06
Generated
2026-07-06
AI Q&A
2026-01-06
EPSS Evaluated
2026-07-05
NVD
CVE-2026-21675
EUVD
EUVD-2026-1150

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
internationalcolorconsortium iccdev to 2.3.1.2 (exc)
internationalcolorconsortium iccdev to 2.3.1.2 (inc)
internationalcolorconsortium iccdev to 2.3.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-21675 is a Use After Free vulnerability in the iccDEV library, specifically in the CIccXform::Create() function. The issue occurs because a hint object (pNamedColorHint) is added to a hint manager which takes ownership of it, but the code then manually deletes this hint, leading to a situation where the program accesses memory that has already been freed. This can cause memory corruption or crashes. The vulnerability affects versions 2.3.1 and below and is fixed in version 2.3.1.1 and later. [1, 2, 3]

Impact Analysis

This vulnerability can have severe impacts including unauthorized data access, unauthorized data modification, and service disruption. Because it is a Use After Free bug, it can lead to memory corruption or crashes, potentially allowing remote attackers to exploit the system without any privileges or user interaction. The CVSS score is 9.8, indicating critical severity with high impact on confidentiality, integrity, and availability. [3]

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade the iccDEV library to version 2.3.1.2 or later, where the Use After Free issue in the CIccXform::Create() function has been fixed. Avoid using versions 2.3.1 and below. No workarounds are provided, so updating is the primary mitigation step. [3]

Compliance Impact

The vulnerability allows unauthorized access, modification, and disruption of data due to its high impact on confidentiality, integrity, and availability. This could lead to non-compliance with standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and system availability. However, specific compliance impacts are not detailed in the provided resources. [3]

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-21675. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart