CVE-2026-21676

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-21676

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21676.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-21676

Aliases

GHSA-j5vv-p2hv-c392

Published

2026-01-06T03:07:36.282Z

Modified

2026-07-15T17:53:47.297343Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

iccDEV has a Heap-based Buffer Overflow in its CIccMBB::Validate() function

Details

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have a Heap-based Buffer Overflow in its CIccMBB::Validate function which checks tag data validity. This issue is fixed in version 2.3.1.1.

Database specific

{
    "cwe_ids": [
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21676.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/internationalcolorconsortium/iccdev

Affected ranges

Type

GIT

Repo

https://github.com/internationalcolorconsortium/iccdev

Events

Introduced

Fixed

e9b21d2294add231d3a21698e303ddb2e569dc00

Fixed

e4c38a67d06073b38d58580b0cfc78ca61005f84

Database specific

{
    "cpe": "cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.1.1"
        }
    ]
}

Affected versions

v2.*

v2.2.6

v2.3.1

Database specific

vanir_signatures_modified

"2026-07-15T17:53:47Z"

vanir_signatures

[
    {
        "signature_type": "Function",
        "target": {
            "file": "IccProfLib/IccTagLut.cpp",
            "function": "CIccMBB::Validate"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/e4c38a67d06073b38d58580b0cfc78ca61005f84",
        "id": "CVE-2026-21676-2f61a9ea",
        "signature_version": "v1",
        "digest": {
            "function_hash": "179411655661537952854422766716315234975",
            "length": 2970.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "IccProfLib/IccTagLut.cpp",
            "function": "CIccTagLut16::Validate"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/e4c38a67d06073b38d58580b0cfc78ca61005f84",
        "id": "CVE-2026-21676-4b9d6626",
        "signature_version": "v1",
        "digest": {
            "function_hash": "182016920011363365471423549365288133815",
            "length": 2729.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "IccProfLib/IccTagLut.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/e4c38a67d06073b38d58580b0cfc78ca61005f84",
        "id": "CVE-2026-21676-61d09d1e",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "314602638422921219531661636830792571666",
                "275105931250804803812470410449283802442",
                "177846480519364211282559276116264175384",
                "137988744454197487057446823884499988420",
                "209856165105533349594236491647533595953",
                "23541919856051024572270980041667758270",
                "259299436892422731389317641732238867564",
                "330008416547048336900284978822093642454",
                "189522110667485371129011930640097422767",
                "50211042899164371984671340813869689098",
                "279066612748284876728941377118610627",
                "281053032395586797397343730516655569097",
                "204871971292329702415400419800563535212",
                "29430667744526151348173072026932587962",
                "301575989731108352691334303389933650462",
                "88048110049596061554407327092765263215",
                "299663588474608932814278661819811793260",
                "307346352750179492677308264581903246433",
                "41578930495817216495978205527665330877",
                "334027434438649871487767935954327684218",
                "90252663447016563593618025506827793465",
                "335424202041746382852592992098298135694",
                "274246758785438178380474297608521434358",
                "189522110667485371129011930640097422767",
                "50211042899164371984671340813869689098",
                "279066612748284876728941377118610627",
                "281053032395586797397343730516655569097",
                "204871971292329702415400419800563535212",
                "29430667744526151348173072026932587962",
                "301575989731108352691334303389933650462",
                "88048110049596061554407327092765263215",
                "299663588474608932814278661819811793260",
                "307346352750179492677308264581903246433",
                "41578930495817216495978205527665330877",
                "334027434438649871487767935954327684218",
                "90252663447016563593618025506827793465",
                "335424202041746382852592992098298135694",
                "274246758785438178380474297608521434358"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "IccProfLib/IccTagLut.cpp",
            "function": "CIccTagLut8::Validate"
        },
        "deprecated": false,
        "source": "https://github.com/internationalcolorconsortium/iccdev/commit/e4c38a67d06073b38d58580b0cfc78ca61005f84",
        "id": "CVE-2026-21676-d51e1d84",
        "signature_version": "v1",
        "digest": {
            "function_hash": "192502090993014191864826944293396217286",
            "length": 2681.0
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21676.json"