CVE-2026-21487: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21487 is a memory safety vulnerability in iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. Versions 2.3.1.1 and below are affected by an Out-of-bounds Read (CWE-125), Use of Out-of-range Pointer Offset (CWE-823), and Improper Input Validation (CWE-20) in the CIccProfile::LoadTag function. The vulnerability was discovered and reported on December 21, 2025, with the security advisory published on January 3–6, 2026. The fix was committed on December 22, 2025, and released in version 2.3.1.2. It carries a CVSS v3.1 base score of 6.1 (Moderate) per the GitHub advisory, or 7.1 (High) per NVD (GitHub Advisory, Feedly).

The root cause lies in insufficient validation within CIccProfile::LoadTag in IccProfLib/IccProfile.cpp: the function failed to verify that a tag's claimed size and offset did not exceed the actual file length, enabling out-of-bounds memory reads and use of out-of-range pointer offsets when parsing a maliciously crafted ICC profile. The bug was discovered via LibFuzzer with UndefinedBehaviorSanitizer, which identified a runtime error — loading an invalid value (4160749567) for type icMaterialColorSignature — triggered by a specially crafted .icc file (GitHub Issue #340). The fix (commit 1516e2c) adds two bounds checks: one rejecting tags claiming to reside inside the header or with zero length, and another rejecting tags whose offset plus size exceeds the file's actual length (GitHub Commit). The attack vector is local and requires user interaction — a victim must open a malicious ICC profile file.

Successful exploitation can cause the application processing the malicious ICC profile to crash (denial of service via out-of-memory or undefined behavior) or leak sensitive data from process memory. The vulnerability has high availability impact and low-to-high confidentiality impact depending on the scoring source, with no integrity impact. The scope is limited to the affected process and does not inherently enable lateral movement, but memory disclosure could expose sensitive data handled by the application (GitHub Advisory, Feedly).

A proof-of-concept (PoC) exploit — a crafted .icc file with a specific byte sequence — is publicly available in the GitHub issue tracker (GitHub Issue #340). There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term (Feedly). Exploitation requires local access and user interaction, limiting the practical attack surface.

1. Craft malicious ICC profile: Create a specially crafted .icc file where tag entries in the profile header specify offset and size values that exceed the actual file length, or reference invalid memory regions. The PoC byte sequence from the public issue report can be used as a starting point (GitHub Issue #340).
2. Deliver the file: Deliver the malicious .icc file to the target user via email attachment, file share, or web download, relying on social engineering to prompt the user to open it.
3. Trigger parsing: The victim opens the crafted ICC profile using an application built on iccDEV (e.g., iccDumpProfile), which calls CIccProfile::LoadTag to parse the profile tags.
4. Trigger vulnerability: The unvalidated tag offset/size causes an out-of-bounds read or use of an out-of-range pointer offset, resulting in either a crash (denial of service) or exposure of memory contents to the attacker if output is returned to the user (GitHub Advisory).

• File System: Presence of unexpected or externally sourced .icc files in user download directories or temporary folders; files matching the PoC byte pattern (e.g., headers with 0xff padding and acsp magic bytes in unusual positions).
• Process: Application crashes or abnormal termination of processes using iccDEV when opening ICC profile files; UndefinedBehaviorSanitizer or AddressSanitizer output referencing IccProfile.cpp or IccTagBasic.cpp in instrumented builds.
• Logs: Application error logs showing out-of-memory conditions or runtime errors related to icMaterialColorSignature type loading; crash dumps from iccDumpProfile or similar tools referencing CIccProfile::LoadTag.

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix introduced in commit 1516e2c (December 22, 2025) that validates tag size against the remaining file size before processing (GitHub Commit, GitHub Advisory). No official workarounds are provided by the vendor. As a compensating control, restrict user access to untrusted ICC color profile files and educate users to avoid opening profiles from unknown or unverified sources.

The vulnerability was reported by security researcher xsscx via the iccDEV GitHub issue tracker on December 21, 2025, and remediated by maintainer ChrisCoxArt within one day (GitHub Issue #340, GitHub Advisory). The vulnerability received limited broader media coverage, with automated CVE tracking services (vulners, cvefeed.io, VulDB) picking up the disclosure shortly after publication. No significant community debate or vendor statements beyond the GitHub advisory have been identified.