CVE-2026-21679
Heap Buffer Overflow in iccDEV CIccLocalizedUnicode::GetText
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| internationalcolorconsortium | iccdev | to 2.3.1.2 (inc) |
| internationalcolorconsortium | iccdev | to 2.3.1.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-21679 is a heap-buffer-overflow vulnerability in the iccDEV library, specifically in the function CIccLocalizedUnicode::GetText(). The vulnerability occurs because the function reads beyond the allocated heap buffer when processing localized Unicode text data in ICC color profiles. This happens due to improper bounds checking and buffer size mismanagement, leading to out-of-bounds memory access. Essentially, when the function attempts to read Unicode strings, it can read two bytes past the allocated buffer, causing memory corruption. This flaw was detected by fuzz testing and AddressSanitizer, and it affects versions of iccDEV prior to 2.3.1.2. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to memory corruption, which may cause application crashes or enable attackers to exploit the issue to execute arbitrary code or cause denial of service. Since the vulnerability affects the processing of ICC color profiles, a maliciously crafted profile could trigger the overflow when loaded by the iccDEV library. The CVSS v3.1 score of 8.8 indicates high severity, with impacts on confidentiality, integrity, and availability (all high). The attack vector is network-based and requires some user interaction, but no privileges are needed. Therefore, if you use iccDEV to process ICC profiles, this vulnerability could allow attackers to compromise your system or disrupt services. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability was detected using fuzz testing tools such as LibFuzzer combined with AddressSanitizer, which reported heap-buffer-overflow errors during processing of ICC profiles. To detect this vulnerability on your system, you can run fuzz testing on the iccDEV library or any application using it, focusing on processing ICC color profiles with malformed multi-localized Unicode tags. There are no specific network or system commands provided to detect this vulnerability directly. Instead, monitoring for crashes or memory corruption events related to iccDEV when handling ICC profiles may help identify exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the iccDEV library to version 2.3.1.2 or later, where the vulnerability has been patched. The fix includes improved buffer boundary checks, safer buffer allocations with double null-termination, validation of tag lengths, and safer string copying to prevent heap-buffer-overflow. No workarounds are provided, so applying the official patch or updated version is necessary to protect against exploitation. [2, 3, 4]