CVE-2026-21693
Type Confusion in iccDEV ICC Profile Processing Library
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| iccdev | iccdev | to 2.3.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-681 | When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur. |
| CWE-754 | The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. |
| CWE-843 | The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Type Confusion issue in the iccDEV library, specifically in the function CIccSegmentedCurveXml::ToXml() within the IccXML/IccLibXML/IccMpeXml.cpp file. It affects versions prior to 2.3.1.2 and involves improper handling of ICC color management profiles, which can lead to unexpected behavior or exploitation.
How can this vulnerability impact me? :
The vulnerability has a high severity with a CVSS base score of 8.8, indicating it can be exploited remotely without privileges but requires user interaction. It can lead to high impact on confidentiality, integrity, and availability, meaning attackers could potentially execute arbitrary code, cause data corruption, or disrupt services when processing ICC color profiles using the affected iccDEV library.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the iccDEV library to version 2.3.1.2 or later, which contains the patch for the Type Confusion vulnerability. No known workarounds are available.