CVE-2026-21490: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21490 is a heap buffer overflow vulnerability in the iccDEV library's CIccTagLut16::Validate() function, triggered when processing malformed ICC color profiles. It affects all iccDEV versions prior to 2.3.1.2 and was disclosed on January 6, 2026, with a patch released in version 2.3.1.2. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) per NVD, while the GitHub Security Advisory rates it as Moderate (6.1) (GitHub Advisory, Red Hat CVE).

The root cause is an off-by-one error (CWE-193) during LUT validation in IccTagLut.cpp that leads to a heap-based buffer overflow (CWE-122) and out-of-bounds read (CWE-125). Specifically, the CIccTagLut16::Validate() function derived input/output channel counts from the ICC profile header's PCS and colorspace fields rather than from the actual LUT data read (m_nInput/m_nOutput), causing it to iterate beyond allocated curve arrays when the LUT's channel counts don't match the profile header. The bug was triggered at IccTagLut.cpp:5305 and 5346 in two distinct code paths — one for input curves and one for output curves — and the same class of error also existed in CIccTagLut8::Validate() and CIccTagLutBtoA::Validate(). The fix (commits 7c2cb71 and e91fe72) replaces header-derived channel counts with the actual counts read from the LUT structure (GitHub Issue #397, Patch Commit).

Successful exploitation can result in application crashes (denial of service) or disclosure of sensitive heap memory contents, impacting both availability and confidentiality. The vulnerability requires a local attacker to craft a malicious ICC color profile and trick a user into opening it with an application using the iccDEV library. Integrity is not directly impacted, and there is no evidence of lateral movement potential beyond the affected process (GitHub Advisory).

A proof-of-concept is publicly available via the GitHub issue tracker (Issue #397), which includes sample fuzzed ICC profile files that trigger the vulnerability. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term (GitHub Issue #397).

1. Craft a malicious ICC profile: Create or modify an ICC color profile file such that the LUT tag's input or output curve counts do not match the PCS/colorspace values declared in the profile header. Sample fuzzed files (mt600za7_148848.pf, mt600za7_222921.pf) are referenced in the public issue report.
2. Deliver the profile to the target: Distribute the malicious .icc/.pf file via email, download, or shared storage, targeting users of applications that use the iccDEV library for color profile processing.
3. Trigger profile validation: Induce the victim to open the file with an iccDEV-based tool (e.g., iccDumpProfile -v <malicious_file>), which invokes CIccTagLut16::Validate() during profile validation.
4. Trigger heap buffer overflow: The validation function reads 8 bytes past the end of the allocated curve array at IccTagLut.cpp:5305 or 5346, resulting in an out-of-bounds read that can crash the application or leak heap memory contents (GitHub Issue #397).

• File System: Presence of unexpected or externally sourced .icc, .icm, or .pf ICC profile files in user directories or temporary folders, particularly those with mismatched LUT channel counts.
• Process: Application crashes or abnormal termination of processes using the iccDEV library (e.g., iccDumpProfile) when processing ICC profiles; AddressSanitizer (ASan) reports of heap-buffer-overflow in CIccTagLut16::Validate() at IccTagLut.cpp:5305 or 5346.
• Logs: Crash logs or core dumps referencing CIccTagLut16::Validate, CIccTagLut8::Validate, or CIccTagLutBtoA::Validate stack frames; error messages indicating invalid LUT channel counts during profile validation (GitHub Issue #397).

Upgrade iccDEV to version 2.3.1.2 or later, which contains fixes in commits 7c2cb71 and e91fe72. No workarounds are available — patching is the only effective mitigation. As an interim measure, restrict user access to untrusted ICC color profile sources and consider sandboxing applications that process ICC profiles to limit potential impact (GitHub Advisory).

The vulnerability was reported by security researcher xsscx and remediated by ChrisCoxArt (the iccDEV maintainer), with the fix committed promptly after the January 1, 2026 bug report. Red Hat has acknowledged the CVE in their security tracking system. No significant broader media coverage or notable community commentary beyond the GitHub issue and advisory has been identified (GitHub Advisory, Red Hat CVE).