CVE-2026-21489
Published: 06 January 2026
Summary
CVE-2026-21489 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Color Iccdev. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21489 affects iccDEV, a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and earlier contain out-of-bounds read (CWE-125) and integer underflow (wrap or wraparound, CWE-191) vulnerabilities in the CIccCalculatorFunc::SequenceNeedTempReset function. The issue was disclosed on January 6, 2026, with a CVSS v3.1 base score of 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) and resolved in version 2.3.1.2.
An attacker with local access can exploit this vulnerability with low complexity and no privileges required, but it necessitates user interaction, such as opening a malicious ICC profile. Successful exploitation may result in limited disclosure of sensitive information alongside high-impact availability disruption, such as application crashes or denial of service, due to the out-of-bounds read and integer underflow.
The official GitHub security advisory (GHSA-ph89-6q5h-wfw5) and fixing commit (cfabfe52c9c7eb0481b62c8aad56580bb11efdad) recommend upgrading to iccDEV version 2.3.1.2, which addresses the flaws in the affected function. No additional workarounds are specified in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1158
Vulnerability details
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have Out-of-bounds Read and Integer Underflow (Wrap or Wraparound) vulnerabilities in its CIccCalculatorFunc::SequenceNeedTempReset function. This issue is fixed in version 2.3.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in ICC profile parsing enables delivery and execution of malicious files (requiring user interaction) to trigger OOB read/integer underflow for DoS and limited data disclosure.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor patch that eliminates the integer underflow and out-of-bounds read in CIccCalculatorFunc::SequenceNeedTempReset.
Mandates validation of ICC profile input before it reaches the vulnerable SequenceNeedTempReset function, blocking the malformed data that triggers the flaws.
Requires integrity verification of the iccDEV library binary and configuration, ensuring only the patched 2.3.1.2 version is loaded and detecting unauthorized or corrupted components.