CVE-2026-21485
- Source
- https://cve.org/CVERecord?id=CVE-2026-21485
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21485.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-21485
- Aliases
-
- GHSA-chp2-4gv5-2432
- Published
- 2026-01-06T03:17:47.555Z
- Modified
- 2026-07-15T21:28:14.687847Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- iccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag()
- Details
-
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (UB) and Out of Memory errors. This issue is fixed in version 2.3.1.2.
- Database specific
{ "cwe_ids": [ "CWE-125", "CWE-1284", "CWE-190", "CWE-20", "CWE-400", "CWE-476", "CWE-787" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21485.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21485.json
- https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-chp2-4gv5-2432
- https://nvd.nist.gov/vuln/detail/CVE-2026-21485
- https://github.com/InternationalColorConsortium/iccDEV/issues/340
- https://github.com/InternationalColorConsortium/iccDEV/commit/c136aac51d25cbb4d9db63f071edad4f088843df
Affected packages
Git / github.com/internationalcolorconsortium/iccdev
Affected ranges
- Type
- GIT
- Repo
- https://github.com/internationalcolorconsortium/iccdev
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
{ "cpe": "cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "2.3.1.2" } ], "source": [ "CPE_RANGE", "REFERENCES" ] }
Database specific
vanir_signatures_modified
"2026-07-15T21:28:14Z"
vanir_signatures
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 313.0,
"function_hash": "159933681341319107307667861077722741547"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-002d3eeb",
"target": {
"function": "CIccIO::WriteUInt8Float",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 316.0,
"function_hash": "72198981426851602649468488027387094472"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-0091fddd",
"target": {
"function": "CIccIO::WriteUInt16Float",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 139.0,
"function_hash": "70180301794830415777772320953458221691"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-03592ff8",
"target": {
"function": "CIccFileIO::Read8",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 338.0,
"function_hash": "5283054794902867417196259679856517651"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-08260737",
"target": {
"function": "CIccIO::ReadFloat32Float",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 149.0,
"function_hash": "42224239577275781987556883135352309571"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-10daa95b",
"target": {
"function": "CIccIO::Read64",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1219.0,
"function_hash": "320654769051940937672016028635186552240"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-219940d5",
"target": {
"function": "CIccTagSpectralViewingConditions::Write",
"file": "IccProfLib/IccTagBasic.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 149.0,
"function_hash": "25525113569844733898251188920370069174"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-26e0523c",
"target": {
"function": "CIccIO::Read16",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"123424981878563344267427862067908547050",
"53965369523888292441555621161536182193",
"81494191593056791969522468103161757221",
"42834334374091928723492250219278492921"
]
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-284d28ac",
"target": {
"file": "IccXML/IccLibXML/IccTagXml.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 242.0,
"function_hash": "236539271719761550907513233149340217106"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-2c3f3d1f",
"target": {
"function": "CIccMemIO::Read8",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 374.0,
"function_hash": "214861853337641299169043586274200351905"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-37118c42",
"target": {
"function": "CIccIO::Write64",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 261.0,
"function_hash": "141245226592201254930550755181146418789"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-47fdfcef",
"target": {
"function": "CIccIO::ReadFloat16Float",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 262.0,
"function_hash": "310748164458488631996764443608190969145"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-745e3f29",
"target": {
"function": "CIccIO::WriteFloat16Float",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 278.0,
"function_hash": "153069426914801185972054285562334416324"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-771b9b3f",
"target": {
"function": "CIccIO::ReadUInt8Float",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"69892222271355513751740617362564100090",
"70856907202370280579620071558587800361",
"89585250159010286971019870313082565798",
"256259175014842270325606534082233341063",
"196011022716650806323724270941652446769",
"128509711449893627682765074993310751490",
"279048278316356605972233505052957437371",
"328946490085687499319640354436694707261"
]
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-788ae845",
"target": {
"file": "IccProfLib/IccTagBasic.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 374.0,
"function_hash": "287570535854228719660834756403877309256"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-7a5f3e61",
"target": {
"function": "CIccIO::Write16",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 295.0,
"function_hash": "188335230595654030497512232097229029495"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-88bdee9b",
"target": {
"function": "CIccIO::ReadLine",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 339.0,
"function_hash": "199990546280508215464194242260331311962"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-91bb01b5",
"target": {
"function": "CIccIO::WriteFloat32Float",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 3754.0,
"function_hash": "65820004865997066363365026361446187918"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-b46e8e94",
"target": {
"function": "CIccTagXmlSpectralViewingConditions::ParseXml",
"file": "IccXML/IccLibXML/IccTagXml.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 149.0,
"function_hash": "296483790569184739588165113847714891569"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-b917b290",
"target": {
"function": "CIccIO::Read32",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 281.0,
"function_hash": "133089550488491309852557555411983875436"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-ba7c18a1",
"target": {
"function": "CIccIO::ReadUInt16Float",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 197.0,
"function_hash": "23099259899643195309112151166241793283"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-c56ac0e2",
"target": {
"function": "CIccNullIO::Read8",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 374.0,
"function_hash": "877995445963167059429238164538874412"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-c945c8ed",
"target": {
"function": "CIccIO::Write32",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"116124205541452988196817266418212504397",
"188448966307521632291538742156220567710",
"54473903331637833747692435571981863703",
"36117103126732425825634199247777304008",
"253543281194472573572288372814414441600",
"273497365944329788159052376947400687151",
"279536054483594589620400706094017222322",
"80262185028008068667804260185820190116",
"329517344315977431648358276826221168048",
"238343708370126686373389732842828524200",
"167325643795517660939740645980394164275",
"49409284742254514727886557001891023109",
"1564221706505739572945788887290628022",
"74281462712918379297743829741002738594",
"271293116546641677236214837790584505512",
"58276584344195874590502001527564575348",
"247749981944576535239512637785322334320",
"84196994333652105913719904974987870550",
"197583146720133228144548143815673538978",
"12173097754519671700009726822420437827",
"282571851278092914578598343468062526586",
"224663022692398018832577592651415366928",
"29567765391687890403046205906453598710",
"178167741907758597055823498626942850051",
"194758090174405524754024242522314510396",
"43053498826783772374472038903708870895",
"73128887439730981111271795184005603485",
"212964307117160450839716705523451884303",
"218585069032593045751903601872608294686",
"209504880708761203579053859519156549267",
"324342039312014846739701940883342046206",
"147779411609115358064234219215273417072",
"104064796962899913952992576949594699922",
"228410611750935730468491803740083908455",
"42257338013867942294254173293628899474",
"137867284440781194842628965324536436762",
"13706427906411677035443582276895526135",
"291850736463905691567737381359080449495",
"178048986675319702604290147462447289968",
"251694972799150083207548657299385527361",
"237235249911365913777497849581339992764",
"291850736463905691567737381359080449495",
"230220829271456037739610514093651450567",
"308333993336737481795801663856651666203",
"81468602917273306914241616127333223140",
"69026529764375941268888121129355553716",
"187652118000139147387139635008329117826",
"74975256213172404886926101981000514920",
"88354956053536919854551007427545559611",
"69026529764375941268888121129355553716",
"127281082342725228798263454094055811581",
"127661922383397009057552003793284282691",
"102378775141395253034751904225289340353",
"106970689694482197792452678104559004720",
"134788618369394975662718350187075222661",
"34221370453742291982862746458703050139",
"316893351939464042753580306627088367855",
"69026529764375941268888121129355553716",
"57600399909839360792574746563399493872",
"209644549433055791889530879525565681299",
"272360927017529909629756141372152730927",
"314717208870797349578305954861938470334",
"220764852767248592909716490172295607148",
"104702808600058007119335234101004140240",
"289139889468366462858632733565672792744",
"330436821914893334414141543273517195835",
"277412479357722848151648673460905456349",
"140612827588094706436255574975607143806",
"122666844492935344878212597606509118933",
"315374219367866915143383188636587140192",
"200875182500041606864071993814904990273",
"306288157074156827717651793939455236404",
"84347403786661279032386342359378294109",
"65448568914410896477652538325265648307",
"103833093848943000556466540667277021936",
"197788250314111202347246435397371380991",
"53905535302479009792940995854525118522",
"270825575395999319829149772017947188267",
"139332369766460399975115421552210273845",
"287004315662639619918414495188262508013",
"330823248909273034234698468430196666830",
"212782625733494025259190818622884593043",
"203520788805519230076674647871796368111",
"282061351510708629423168869055096757711"
]
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-d0e8938c",
"target": {
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 266.0,
"function_hash": "281098664606369742974574040945838179808"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-eb3963eb",
"target": {
"function": "CIccMemIO::Write8",
"file": "IccProfLib/IccIO.cpp"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 140.0,
"function_hash": "253488271007254825828773619188175117691"
},
"signature_version": "v1",
"source": "https://github.com/internationalcolorconsortium/iccdev/commit/c136aac51d25cbb4d9db63f071edad4f088843df",
"id": "CVE-2026-21485-f9a916fc",
"target": {
"function": "CIccFileIO::Write8",
"file": "IccProfLib/IccIO.cpp"
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21485.json"