CVE-2026-21491

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-21491
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21491.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-21491
Aliases
  • GHSA-4pv4-4x2x-6j88
Published
2026-01-06T19:07:37.795Z
Modified
2026-07-22T03:08:38.522796Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVSS Calculator
Summary
iccDEV has unicode buffer overflow in CIccTagTextDescription
Details

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV library who process ICC color profiles. It results in unicode buffer overflow in CIccTagTextDescription. Version 2.3.1.2 contains a patch. No known workarounds are available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21491.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122",
        "CWE-125",
        "CWE-193"
    ]
}
References

Affected packages

Git / github.com/internationalcolorconsortium/iccdev

Affected ranges

Type
GIT
Repo
https://github.com/internationalcolorconsortium/iccdev
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ad159eb00bf46fa17496a0f8c4cb49de8918062c
Fixed
7c2cb719a9de1c00844e457e070d657314383ee3
Fixed
e91fe722ac54ce497d410153e7405090e0565d7b
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.1.2"
        }
    ],
    "cpe": "cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*"
}

Affected versions

v2.*
v2.2.6
v2.3.1
v2.3.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21491.json"
vanir_signatures_modified 
"2026-07-22T03:08:38Z"
vanir_signatures 
[
    {
        "target": {
            "file": "IccProfLib/IccTagBasic.cpp",
            "function": "CIccTagTextDescription::ReleaseUnicode"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2026-21491-23c810c3",
        "signature_version": "v1",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/7c2cb719a9de1c00844e457e070d657314383ee3",
        "digest": {
            "function_hash": "238480443815913231375412386355470187501",
            "length": 298.0
        }
    },
    {
        "target": {
            "file": "IccProfLib/IccTagLut.cpp",
            "function": "CIccTagLutBtoA::Validate"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2026-21491-36dba549",
        "signature_version": "v1",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/e91fe722ac54ce497d410153e7405090e0565d7b",
        "digest": {
            "function_hash": "264863499570902772693057447338855116995",
            "length": 2229.0
        }
    },
    {
        "target": {
            "file": "IccProfLib/IccTagLut.cpp",
            "function": "CIccTagLut8::Validate"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2026-21491-46ede28d",
        "signature_version": "v1",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/7c2cb719a9de1c00844e457e070d657314383ee3",
        "digest": {
            "function_hash": "88727902595639887592958986148197238156",
            "length": 2605.0
        }
    },
    {
        "target": {
            "file": "IccProfLib/IccTagLut.cpp",
            "function": "CIccTagLut8::Validate"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2026-21491-619e1c06",
        "signature_version": "v1",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/e91fe722ac54ce497d410153e7405090e0565d7b",
        "digest": {
            "function_hash": "88727902595639887592958986148197238156",
            "length": 2605.0
        }
    },
    {
        "target": {
            "file": "IccProfLib/IccTagBasic.cpp",
            "function": "CIccTagTextDescription::GetUnicodeBuffer"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2026-21491-7696bd55",
        "signature_version": "v1",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/7c2cb719a9de1c00844e457e070d657314383ee3",
        "digest": {
            "function_hash": "13246452113574498721438645670357354560",
            "length": 282.0
        }
    },
    {
        "target": {
            "file": "IccProfLib/IccTagLut.cpp"
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2026-21491-82d70e64",
        "signature_version": "v1",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/e91fe722ac54ce497d410153e7405090e0565d7b",
        "digest": {
            "line_hashes": [
                "310261519772304277551735336582513698660",
                "338528038164514033400348667733904507003",
                "288582851034146135780088944196524866486",
                "231555193325455101289958824016334613239",
                "298149001420100335066733762050993525426",
                "213096614043544219755598063929916141088",
                "72002569946820389005877360816924165630",
                "189926375155409634819876683956782380144",
                "199858654639059139229786569098553387519",
                "161184874290512014137884871512839490858",
                "292312411716896196886238524885637808057",
                "3381378447204666891311949306952683620",
                "251008962939773046567143456274231664953",
                "45010587654971116374951653375847617292",
                "93402651933168580929205382919126224176",
                "96077913549302399755406506243171896507",
                "149385849904708044430200875988358424572",
                "316783519618824458457967263961422973905",
                "265178989716740386787350341187581396521",
                "148338165700613177763182222826754414995",
                "321438906165013307804928463789766043780",
                "197830722839698683879388144812285472907",
                "163613353425442672367005350116496933203",
                "30130692480937777978388867261055172347",
                "175933557636260710531000587662986189790",
                "316783519618824458457967263961422973905",
                "265178989716740386787350341187581396521",
                "148338165700613177763182222826754414995",
                "321438906165013307804928463789766043780",
                "197830722839698683879388144812285472907",
                "163613353425442672367005350116496933203",
                "30130692480937777978388867261055172347",
                "175933557636260710531000587662986189790"
            ],
            "threshold": 0.9
        }
    },
    {
        "target": {
            "file": "IccProfLib/IccTagLut.cpp",
            "function": "CIccTagLut16::Validate"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2026-21491-848c7078",
        "signature_version": "v1",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/7c2cb719a9de1c00844e457e070d657314383ee3",
        "digest": {
            "function_hash": "208338650828301210044478373789440101332",
            "length": 2653.0
        }
    },
    {
        "target": {
            "file": "IccProfLib/IccTagLut.cpp",
            "function": "CIccTagLut16::Validate"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2026-21491-899eee8f",
        "signature_version": "v1",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/e91fe722ac54ce497d410153e7405090e0565d7b",
        "digest": {
            "function_hash": "208338650828301210044478373789440101332",
            "length": 2653.0
        }
    },
    {
        "target": {
            "file": "IccProfLib/IccTagBasic.cpp"
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2026-21491-e48ddfd2",
        "signature_version": "v1",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/7c2cb719a9de1c00844e457e070d657314383ee3",
        "digest": {
            "line_hashes": [
                "269766507217604602064197648372866490850",
                "131615335011238944694340028062853939406",
                "240889578023398330783644359630296266521",
                "256233971390957598340978720875535891315",
                "52198477403427735118829030511958474886",
                "224952263998007224650498123981888622496",
                "1739408669773347512553000923360977374",
                "152637986210647203900536967181221505312",
                "237241450764000839443208422514905910861",
                "94017901343229524927095137396808930471",
                "24228197736809018559475842138979768737",
                "321278999918424772238947224050824071111",
                "260141537856744822279103988786629250295",
                "120185617744595567086507221874756838243",
                "190446695660087690616287272332644109881"
            ],
            "threshold": 0.9
        }
    },
    {
        "target": {
            "file": "IccProfLib/IccTagLut.cpp",
            "function": "CIccTagLutBtoA::Validate"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2026-21491-f814df32",
        "signature_version": "v1",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/7c2cb719a9de1c00844e457e070d657314383ee3",
        "digest": {
            "function_hash": "264863499570902772693057447338855116995",
            "length": 2229.0
        }
    },
    {
        "target": {
            "file": "IccProfLib/IccTagLut.cpp"
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2026-21491-fcc3aee0",
        "signature_version": "v1",
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/7c2cb719a9de1c00844e457e070d657314383ee3",
        "digest": {
            "line_hashes": [
                "310261519772304277551735336582513698660",
                "338528038164514033400348667733904507003",
                "288582851034146135780088944196524866486",
                "231555193325455101289958824016334613239",
                "298149001420100335066733762050993525426",
                "213096614043544219755598063929916141088",
                "72002569946820389005877360816924165630",
                "189926375155409634819876683956782380144",
                "199858654639059139229786569098553387519",
                "161184874290512014137884871512839490858",
                "292312411716896196886238524885637808057",
                "3381378447204666891311949306952683620",
                "251008962939773046567143456274231664953",
                "45010587654971116374951653375847617292",
                "93402651933168580929205382919126224176",
                "96077913549302399755406506243171896507",
                "149385849904708044430200875988358424572",
                "316783519618824458457967263961422973905",
                "265178989716740386787350341187581396521",
                "148338165700613177763182222826754414995",
                "321438906165013307804928463789766043780",
                "197830722839698683879388144812285472907",
                "163613353425442672367005350116496933203",
                "30130692480937777978388867261055172347",
                "175933557636260710531000587662986189790",
                "316783519618824458457967263961422973905",
                "265178989716740386787350341187581396521",
                "148338165700613177763182222826754414995",
                "321438906165013307804928463789766043780",
                "197830722839698683879388144812285472907",
                "163613353425442672367005350116496933203",
                "30130692480937777978388867261055172347",
                "175933557636260710531000587662986189790"
            ],
            "threshold": 0.9
        }
    }
]