CVE-2026-21491: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21491 is a unicode buffer overflow vulnerability in the iccDEV library affecting the CIccTagTextDescription component. It impacts all versions of iccDEV prior to 2.3.1.2 and was disclosed on January 6, 2026, with the patch released shortly after. The vulnerability has a CVSS v3.1 base score of 7.1 (High) per NVD, or 6.1 (Moderate) per the GitHub Security Advisory, depending on the scoring authority (GitHub Advisory, Red Hat CVE).

The root cause is an off-by-one error (CWE-193) in the GetUnicodeBuffer() function within IccTagBasic.cpp, which fails to allocate sufficient space for NULL termination of unicode strings, leading to a heap-based buffer overflow (CWE-122) and out-of-bounds read (CWE-125). Specifically, the ReleaseUnicode() method at IccTagBasic.cpp:2373 iterates over the unicode buffer without a bounds check, reading past the end of a heap-allocated 2-byte region when processing a unicode string of length 1. The bug was discovered via fuzzing using AddressSanitizer (ASan), which reported a READ of size 2 past the end of a [0x602000000250, 0x602000000252) region. The fix in commit 7c2cb71 adds proper bounds checking and ensures double-NULL termination of unicode buffers (GitHub Issue #396, Patch Commit).

Successful exploitation can result in high availability impact (application crash or denial of service) and potential confidentiality impact through heap memory disclosure, as the out-of-bounds read may expose adjacent heap contents. Integrity is not directly affected. The attack is local and requires user interaction — a victim must open or process a maliciously crafted ICC color profile file — limiting the blast radius to applications and users that process untrusted ICC profiles (GitHub Advisory, Red Hat CVE).

A proof-of-concept is publicly available as a fuzzed ICC profile file (mt600za7_73352.pf) referenced in GitHub Issue #396, which reliably triggers the ASan-detected heap buffer overflow when processed with iccDumpProfile -v (GitHub Issue #396). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term (Red Hat CVE).

1. Craft a malicious ICC profile: Create or obtain a specially crafted ICC color profile file containing a CIccTagTextDescription tag with a unicode string of length 1 (or other edge-case lengths) that triggers the off-by-one allocation error. The fuzzed file mt600za7_73352.pf from Issue #396 is a known trigger.
2. Deliver the file: Distribute the malicious .icc or .pf profile file to a target user via email, download, or embedding in a document — any vector that causes the victim to open or process the file with an application using the iccDEV library.
3. Trigger processing: The victim opens the file with an iccDEV-based tool (e.g., iccDumpProfile -v <malicious_file>) or an application that internally calls CIccProfile::ReadValidate(), which invokes CIccTagTextDescription::Read() and subsequently ReleaseUnicode().
4. Heap buffer overflow occurs: The unbounded loop for (i=0; m_uzUnicodeText[i]; i++) in ReleaseUnicode() reads 2 bytes past the end of the allocated heap buffer, causing a crash (denial of service) or potentially leaking adjacent heap memory contents. (GitHub Issue #396, Patch Commit)

• Process: Application crashes or abnormal termination of processes using iccDEV when opening ICC profile files; AddressSanitizer output referencing CIccTagTextDescription::ReleaseUnicode() at IccTagBasic.cpp:2373.
• Logs: Crash reports or core dumps from iccDEV-based tools (e.g., iccDumpProfile) with stack traces involving CIccProfile::LoadTag, CIccProfile::ReadValidate, or CIccTagTextDescription::Read.
• File System: Presence of unexpected or externally sourced .icc or .pf ICC profile files in user directories or temporary folders, particularly files with malformed desc tags containing short unicode strings. (GitHub Issue #396)

Upgrade iccDEV to version 2.3.1.2 or later, which contains the fix introduced in commits 7c2cb71 and e91fe72. No configuration-based workarounds are available for unpatched versions. As an interim measure, restrict processing of ICC color profiles to files from trusted sources only, and educate users to avoid opening ICC profile files from unknown origins (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher xsscx and remediated by ChrisCoxArt (the iccDEV maintainer), with the fix committed promptly after the issue was filed on January 1, 2026. Red Hat tracked the CVE and published their own advisory entry. No significant broader media coverage or notable community debate has been observed beyond the GitHub issue and advisory threads (GitHub Advisory, Red Hat CVE).