CVE-2026-21489: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21489 is a pair of memory safety vulnerabilities — Out-of-bounds Read (CWE-125) and Integer Underflow/Wraparound (CWE-191) — affecting the iccDEV library maintained by the International Color Consortium. The flaws reside in the CIccCalculatorFunc::SequenceNeedTempReset function and affect iccDEV versions 2.3.1.1 and below. The vulnerability was published on January 6, 2026, with a fix released in version 2.3.1.2. It carries a CVSS v3.1 base score of 7.1 (High) per Feedly/NVD, or 6.1 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is insufficient bounds checking in CIccCalculatorFunc::SequenceNeedTempReset within IccProfLib/IccMpeCalc.cpp. When processing ICC color profile data, the function computes an offset p (e.g., p = i+2) and passes it to recursive calls without first verifying that p does not exceed the total operation count nOps. This allows an integer underflow when computing nOps-p, resulting in a very large value passed to icIntMin, which in turn enables an out-of-bounds read of memory beyond the intended buffer. The fix (commit cfabfe5) adds explicit checks (if (p > nOps) return true/return -1) at multiple locations before the subtraction occurs. Exploitation requires a user to open or process a specially crafted malicious ICC color profile file (GitHub Advisory, Patch Commit).

Successful exploitation can result in two distinct impacts: leakage of sensitive data from process memory via the out-of-bounds read, and a denial-of-service condition triggered by the integer underflow/wraparound. The attack vector is local, meaning an attacker must be able to supply a malicious ICC profile file to a user or application that processes it using the vulnerable iccDEV library. Integrity is not impacted, but confidentiality (memory disclosure) and availability (crash/DoS) are both rated High in the primary CVSS scoring (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. User interaction is required — a victim must open or process a crafted ICC profile — which further limits the practical attack surface (GitHub Advisory, Red Hat CVE).

1. Craft a malicious ICC profile: Create a specially crafted ICC color profile file that contains calculator function sequences designed to trigger the integer underflow in CIccCalculatorFunc::SequenceNeedTempReset — specifically, sequences where the computed offset p (e.g., i+2) exceeds the total operation count nOps.
2. Deliver the file to the target: Distribute the malicious .icc profile to a user or system that processes ICC profiles using the vulnerable iccDEV library (versions ≤ 2.3.1.1), for example via email attachment, download, or embedding in a document.
3. Trigger processing: Induce the victim to open or process the malicious ICC profile through an application that uses the iccDEV library (e.g., a color management tool or image processing application).
4. Achieve out-of-bounds read: The integer underflow causes nOps-p to wrap to a very large value, causing SequenceNeedTempReset to read memory beyond the intended buffer boundary, potentially leaking sensitive process memory.
5. Trigger denial of service: The same underflow condition can cause the application to crash, resulting in a denial-of-service condition (GitHub Advisory, Patch Commit).

• File System: Unexpected or unknown .icc color profile files delivered to users or placed in directories accessible by ICC-processing applications.
• Process: Abnormal crashes or termination of applications that use the iccDEV library (e.g., color management tools, image processors) when opening ICC profile files; crash dumps referencing IccMpeCalc.cpp or CIccCalculatorFunc::SequenceNeedTempReset.
• Logs: Application error logs showing segmentation faults, access violations, or unhandled exceptions originating from IccProfLib components; stack traces referencing SequenceNeedTempReset or CheckUnderflowOverflow functions.

The vendor has released iccDEV version 2.3.1.2, which addresses both vulnerabilities by adding explicit bounds checks before subtraction operations in CIccCalculatorFunc::SequenceNeedTempReset and CheckUnderflowOverflow. All users of iccDEV versions 2.3.1.1 and below should upgrade to 2.3.1.2 immediately. No official workarounds are provided by the vendor; as interim measures, administrators should implement access controls to restrict processing of ICC profiles from untrusted sources and limit user access to iccDEV libraries until patching is complete (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher xsscx and disclosed via the GitHub Security Advisory program. Red Hat has tracked the CVE in their security advisory database. No significant broader media coverage or notable community commentary beyond standard vulnerability tracking has been observed (GitHub Advisory, Red Hat CVE).