CVE-2026-21492: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21492 is a NULL pointer dereference vulnerability in the iccDEV library's ToneMap Writer component, affecting all versions prior to 2.3.1.2. The flaw was reported on December 31, 2025, patched on January 1, 2026, and publicly disclosed on January 6, 2026. It affects the CIccMpeToneMap::Write() function in IccProfLib/IccMpeBasic.cpp when processing ICC color profiles with missing or malformed ToneMap elements. The CVSS v3.1 base score is 5.5 (Medium) (GitHub Advisory, Red Hat CVE).

The vulnerability is classified under CWE-476 (NULL Pointer Dereference) and CWE-252 (Unchecked Return Value). In IccProfLib/IccMpeBasic.cpp at line 4051, the CIccMpeToneMap::Write() function calls methods on m_pLumCurve and m_pToneFuncs[] pointers without first verifying they are non-NULL. When a crafted ICC profile is parsed via iccFromXml with missing luminance curve or ToneMap function elements, these pointers remain NULL, and the subsequent member call triggers undefined behavior detected by UndefinedBehaviorSanitizer as a runtime error. The fix adds null checks before dereferencing (if (!m_pLumCurve || !m_pLumCurve->Write(pIO))) and adds early return false in the XML parser when required elements are absent (GitHub Issue #394, Fix Commit).

Successful exploitation causes a denial of service through application crash in any software that uses the iccDEV library to process ICC color profiles. The impact is limited to availability (rated High), with no confidentiality or integrity compromise. Applications such as image editors, color management tools, or print workflows that accept user-supplied ICC profile files are at risk of being crashed by a maliciously crafted profile (GitHub Advisory).

A proof-of-concept exploit file (NPD-CIccToneMapFunc-Write.icc.txt) was published alongside the issue report on GitHub, demonstrating the crash via the iccFromXml tool (GitHub Issue #394). Exploitation requires local access and user interaction (opening a malicious ICC profile), limiting the attack surface. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the EPSS score is approximately 0.012% — indicating very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA KEV catalog.

1. Craft a malicious ICC profile: Create an ICC color profile XML file (e.g., using iccFromXml) that includes a ToneMap multiprocess element with missing or incomplete luminance curve or ToneMap function entries, as demonstrated in the public PoC file NPD-CIccToneMapFunc-Write.icc.txt.
2. Deliver the file: Provide the crafted ICC profile to a target user or system that uses an application built on the iccDEV library (e.g., a color management tool or image processor).
3. Trigger processing: Induce the application to open or process the malicious ICC profile, causing CIccMpeToneMap::Write() in IccProfLib/IccMpeBasic.cpp to be invoked.
4. Achieve denial of service: The NULL pointer member call at line 4051 triggers undefined behavior, causing the application to crash with a UndefinedBehaviorSanitizer error: runtime error: member call on null pointer of type 'CIccToneMapFunc *' (GitHub Issue #394).

• File System: Presence of unexpected or externally sourced .icc or .icc.txt files, particularly those with malformed or incomplete ToneMap multiprocess elements.
• Logs/Process: Application crash logs or core dumps referencing IccProfLib/IccMpeBasic.cpp:4051 or CIccToneMapFunc; UndefinedBehaviorSanitizer output containing runtime error: member call on null pointer of type 'CIccToneMapFunc *'.
• Process: Unexpected termination of applications using the iccDEV library when processing ICC profile files from untrusted sources (GitHub Issue #394).

Upgrade iccDEV to version 2.3.1.2 or later, which includes fixes in commits b200a62 and e72361d. No configuration-based workarounds are available. Organizations should prioritize updating all applications and tools that depend on the iccDEV library, especially those that process untrusted or user-supplied ICC color profile files (GitHub Advisory, Fix PR #401).