CVE-2026-21486

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-21486
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21486.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-21486
Aliases
  • GHSA-mg98-j5q2-674w
Published
2026-01-06T03:36:45.786Z
Modified
2026-07-22T03:08:34.353057Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Use After Free and Heap-based Buffer Overflow and Integer Overflow or Wraparound and Out-of-bounds Write in iccDEV
Details

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below contain Use After Free, Heap-based Buffer Overflow and Integer Overflow or Wraparound and Out-of-bounds Write vulnerabilities in its CIccSparseMatrix::CIccSparseMatrix function. This issue is fixed in version 2.3.1.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122",
        "CWE-190",
        "CWE-416",
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21486.json"
}
References

Affected packages

Git / github.com/internationalcolorconsortium/iccdev

Affected ranges

Type
GIT
Repo
https://github.com/internationalcolorconsortium/iccdev
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ad159eb00bf46fa17496a0f8c4cb49de8918062c
Fixed
1ab7363f38a20089934d3410c88f714eea392bf5
Database specific 
{
    "cpe": "cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.1.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.2.6
v2.3.1
v2.3.1.1

Database specific

vanir_signatures_modified 
"2026-07-22T03:08:34Z"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/1ab7363f38a20089934d3410c88f714eea392bf5",
        "id": "CVE-2026-21486-216293ba",
        "deprecated": false,
        "target": {
            "file": "IccProfLib/IccSparseMatrix.h"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "130424312403547948677111747287670156735",
                "187534651731023147624044080364899077248",
                "59356083406962163983250408442506307166",
                "325530905932445559871608336515433764542",
                "171924246581448522103128009274983519238",
                "296250104893568564531920420672728868319",
                "263686478938824869619518612842678610974",
                "77309182047740543095161860898510194514",
                "247202735996410909293933754387100030469",
                "245414195817605668230765711883314208528",
                "213357881863179878721326929641651622163",
                "202536308936789209916288490519865081345"
            ]
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/1ab7363f38a20089934d3410c88f714eea392bf5",
        "id": "CVE-2026-21486-7107ffa0",
        "deprecated": false,
        "target": {
            "file": "IccProfLib/IccSparseMatrix.cpp"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "163216628640628721669453518707903786211",
                "328057863684649751206955633308035149906",
                "116618537522970346556148365744244073812",
                "92696027061272639701984115856114236197",
                "270875108165058976016979804518418535750",
                "222596614708385699979317975357946139205",
                "309738717714683799841499967579344377481",
                "294323222760664064363360168244213443504",
                "155579860729037132480243799190423432177",
                "108352464738249779223490409992655730944",
                "140036793497359538456366015798440502092",
                "307717983509999204716337249437268533634"
            ]
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/1ab7363f38a20089934d3410c88f714eea392bf5",
        "id": "CVE-2026-21486-c57ec29d",
        "deprecated": false,
        "target": {
            "file": "IccProfLib/IccTagBasic.cpp"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "246634793945460460610231596378213899023",
                "289205807299869172319016736535971397562",
                "316820413624776651221137402134512115668",
                "316979863080597211598509565594037080220",
                "32774653930963967206683982978395990770",
                "79769079361438964922831567051267990731",
                "124666518803179751163703803059866591879",
                "28941563976791037186155366056884096335",
                "71089988135891961670571673659843308473",
                "276045603918256787775668276428889804766",
                "150079535757648783990606504384037411581",
                "134966753583523819124162630582498473711",
                "277352595377321512828029813849061033665",
                "96489432806621183810948907428918578109",
                "322080652867696267748583550017520820787"
            ]
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/1ab7363f38a20089934d3410c88f714eea392bf5",
        "id": "CVE-2026-21486-dfdbd021",
        "deprecated": false,
        "target": {
            "file": "IccProfLib/IccTagBasic.cpp",
            "function": "CIccTagSparseMatrixArray::Write"
        },
        "digest": {
            "length": 1688.0,
            "function_hash": "109415455049594274886175607589149965377"
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/1ab7363f38a20089934d3410c88f714eea392bf5",
        "id": "CVE-2026-21486-e16eae5f",
        "deprecated": false,
        "target": {
            "file": "IccProfLib/IccSparseMatrix.cpp",
            "function": "CIccSparseMatrix::Init"
        },
        "digest": {
            "length": 1482.0,
            "function_hash": "1118452912623758405591770621510271123"
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/1ab7363f38a20089934d3410c88f714eea392bf5",
        "id": "CVE-2026-21486-ee422fb0",
        "deprecated": false,
        "target": {
            "file": "IccProfLib/IccTagBasic.cpp",
            "function": "CIccTagSparseMatrixArray::Read"
        },
        "digest": {
            "length": 3869.0,
            "function_hash": "136873069859591116726427449953346583285"
        },
        "signature_version": "v1"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21486.json"