CVE-2026-21486: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21486 is a set of memory safety vulnerabilities — Use After Free (CWE-416), Heap-based Buffer Overflow (CWE-122), Integer Overflow or Wraparound (CWE-190), and Out-of-bounds Write (CWE-787) — in the CIccSparseMatrix::CIccSparseMatrix function of the iccDEV library. iccDEV is an open-source toolkit maintained by the International Color Consortium for working with ICC color management profiles. All versions up to and including 2.3.1.1 are affected; the vulnerability was disclosed on January 3–6, 2026, and fixed in version 2.3.1.2. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause lies in the CIccSparseMatrix constructor and related functions in IccSparseMatrix.cpp, where size parameters were typed as 32-bit integers (icUInt32Number) rather than 64-bit values (size_t/icUInt64Number), enabling integer overflow when calculating sparse matrix sizes and offsets. This overflow can lead to under-allocation of heap memory, which is then written beyond its bounds (out-of-bounds write / heap buffer overflow), and previously freed memory may be reused (use-after-free). The fix, committed December 22, 2025 (commit 1ab7363), promotes size fields to 64-bit types, adds a bounds check against the 4 GB file size limit before writing, and adds safety guards throughout offset calculations (GitHub Commit, GitHub Advisory). Exploitation requires a local attacker to supply a maliciously crafted ICC color profile that a victim user opens or processes with an application using the vulnerable iccDEV library.

Successful exploitation can result in arbitrary code execution with the privileges of the user processing the malicious ICC profile, with high impact to confidentiality, integrity, and availability of the affected system. An attacker who achieves code execution could access sensitive data, modify system files, or cause a denial of service. While the attack vector is local and requires user interaction, the lack of required privileges lowers the barrier for exploitation in environments where users routinely open color-managed documents or images (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious ICC profile: Create a specially crafted ICC color profile file containing a sparse matrix tag with manipulated size fields designed to trigger integer overflow in CIccSparseMatrix::CIccSparseMatrix when parsed by a vulnerable iccDEV version (≤ 2.3.1.1).
2. Deliver the payload: Distribute the malicious .icc profile to a target user via email attachment, download link, or embedding within a document or image that triggers ICC profile processing upon opening.
3. Trigger user interaction: Induce the victim to open or process the file using an application that links against the vulnerable iccDEV library (e.g., image editors, color management tools, or document viewers).
4. Trigger memory corruption: When the application parses the sparse matrix tag, the integer overflow causes an undersized heap allocation; subsequent writes overflow the buffer or access freed memory, corrupting heap metadata.
5. Achieve code execution: By controlling heap layout through the crafted profile, an attacker can redirect execution flow to attacker-controlled code, achieving arbitrary code execution in the context of the victim user (GitHub Advisory, GitHub Commit).

• File System: Unexpected or suspicious .icc profile files in user download directories, temporary folders, or email attachment staging areas; presence of iccDEV library versions ≤ 2.3.1.1 on the system.
• Process: Unusual child processes spawned by image editors, color management utilities, or document viewers (e.g., cmd.exe, powershell.exe, bash, curl) following the opening of an ICC profile file; application crashes or unexpected termination when processing ICC profiles (indicative of failed exploitation attempts).
• Logs: Application crash logs or core dumps referencing IccSparseMatrix.cpp or CIccSparseMatrix; heap corruption error messages in application logs.

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix introduced in commit 1ab7363 (December 22, 2025) that adds 64-bit size handling and bounds checks to the sparse matrix parser (GitHub Commit, GitHub Advisory). No official workarounds are provided by the vendor. Until patching is complete, restrict processing of ICC color profiles from untrusted or unknown sources, and avoid opening ICC profile files received from unverified parties.

The vulnerability was reported by security researcher xsscx and remediated by ChrisCoxArt from the International Color Consortium. A brief mention appeared on Bluesky via The Hacker Wire, and the vulnerability was included in CISA's weekly vulnerability bulletin for the week of January 5, 2026. No significant broader media coverage or notable researcher commentary beyond the GitHub advisory has been identified.