CVE-2026-21488

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-21488
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21488.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-21488
Aliases
  • GHSA-4j2g-rvv4-86vg
Published
2026-01-06T13:52:21.380Z
Modified
2026-08-12T15:31:35.888330Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVSS Calculator
Summary
iccDEV has Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination
Details

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination through its CIccTagText::Read function. This issue is fixed in version 2.3.1.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122",
        "CWE-125",
        "CWE-170"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21488.json"
}
References

Affected packages

Git / github.com/internationalcolorconsortium/iccdev

Affected ranges

Type
GIT
Repo
https://github.com/internationalcolorconsortium/iccdev
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ad159eb00bf46fa17496a0f8c4cb49de8918062c
Fixed
9daaccceb231c43db8cab312ee5bbe9d2aa6b153
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.1.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*"
}

Affected versions

v2.*
v2.2.6
v2.3.1
v2.3.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21488.json"
vanir_signatures 
[
    {
        "target": {
            "file": "IccProfLib/IccTagBasic.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153",
        "id": "CVE-2026-21488-1f4a4150",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "112053873367473987317481232328804214564",
                "183639400736786594935674290888231917450",
                "183696748620832168832735563258355408551",
                "109935662559947153377607870689957425474",
                "289216721379526908910931081133457945981",
                "274291726934222466697134320004752117621",
                "233680629251865353524537826745186845582",
                "305728945917711294397778407256411803293",
                "7148863491717630411893299272751297829",
                "99062364338985417093057235843837789419",
                "335487090220098331220909252406236204370",
                "206759090495761770040848832225516132940",
                "41199927284814296931918923707550240255",
                "289216721379526908910931081133457945981",
                "274291726934222466697134320004752117621",
                "233680629251865353524537826745186845582",
                "305728945917711294397778407256411803293",
                "7148863491717630411893299272751297829",
                "79664735675035722314869020844697711172",
                "165097030602894090159572605601849606733",
                "255124914137808461858265738369444482933",
                "213809964100037604110740721436640559166",
                "77936397294284966625671803786699051515",
                "253930792495905454549173052832020495311",
                "233680629251865353524537826745186845582",
                "305728945917711294397778407256411803293",
                "7148863491717630411893299272751297829",
                "63917277668774302532200798008025484490",
                "267265029416216576855195865617714669205",
                "92540802182261855024743436187735511568",
                "258465017208017860053114594907712828833",
                "289216721379526908910931081133457945981",
                "274291726934222466697134320004752117621",
                "70688350822016584305501734175344091000",
                "143236905889349786205766767374481805474",
                "315739280192301642559226903520043456266",
                "415828319674057432309085997386097568",
                "225200976897218192904848474858908558415",
                "9746067055305428949155105575803507686",
                "182343106838710419286230546836165458927",
                "335371570645204178055694625245782178837",
                "290954544343627734993472348966212321420",
                "185933559475239644283805490749835021499",
                "28894496636036124006770797837264257044",
                "71997541720239693069689759012473954408",
                "280983634641631564853356649922976333996",
                "338826249837255901440910815909394179385",
                "111642647446744223210769518755922625147",
                "152780728962503810666130044593350419771",
                "48683739176627715671032203818854430344",
                "204124109822707829234757470425360989234",
                "288368012872390508492762511155406954785",
                "6937770810566862567808716940819948328",
                "324971070512734625473950134568598264040"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "CIccTagUtf16Text::Read",
            "file": "IccProfLib/IccTagBasic.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153",
        "id": "CVE-2026-21488-3c350ba6",
        "signature_version": "v1",
        "digest": {
            "length": 503.0,
            "function_hash": "95646718285613999726618489367179703200"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "CIccTagNamedColor2::Read",
            "file": "IccProfLib/IccTagBasic.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153",
        "id": "CVE-2026-21488-46728f1c",
        "signature_version": "v1",
        "digest": {
            "length": 1278.0,
            "function_hash": "204593248860531807481187117630830471532"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "CIccTagXYZ::Read",
            "file": "IccProfLib/IccTagBasic.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153",
        "id": "CVE-2026-21488-7892aa48",
        "signature_version": "v1",
        "digest": {
            "length": 559.0,
            "function_hash": "288364720733211411783794038718742831935"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "CIccTagUtf8Text::Read",
            "file": "IccProfLib/IccTagBasic.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153",
        "id": "CVE-2026-21488-8a702c10",
        "signature_version": "v1",
        "digest": {
            "length": 544.0,
            "function_hash": "298863653837398030649055255731647903773"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "CIccTagText::Read",
            "file": "IccProfLib/IccTagBasic.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153",
        "id": "CVE-2026-21488-b46f6b24",
        "signature_version": "v1",
        "digest": {
            "length": 493.0,
            "function_hash": "49019780230613242290726993178351824631"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "CIccTagNamedColor2::SetSize",
            "file": "IccProfLib/IccTagBasic.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153",
        "id": "CVE-2026-21488-de575375",
        "signature_version": "v1",
        "digest": {
            "length": 1017.0,
            "function_hash": "9457177022459509661072428238677682791"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "CIccTagTextDescription::Read",
            "file": "IccProfLib/IccTagBasic.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153",
        "id": "CVE-2026-21488-f6d3415f",
        "signature_version": "v1",
        "digest": {
            "length": 1374.0,
            "function_hash": "249756312980100634008691181854251493409"
        },
        "signature_type": "Function"
    }
]
vanir_signatures_modified 
"2026-08-12T15:31:35Z"