CVE-2026-21494: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21494 is a heap buffer overflow vulnerability in the iccDEV library's CIccTagLut8::Validate() function, triggered when processing malicious ICC color profiles. It affects all iccDEV versions prior to 2.3.1.2 and was published on January 6, 2026. The vulnerability was assigned a CVSS v3.1 base score of 7.1 (High) by NVD, while the GitHub Security Advisory rates it as Moderate with a score of 6.1 (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow), CWE-125 (Out-of-bounds Read), and CWE-193 (Off-by-one Error). In the vulnerable code path, CIccTagLut8::Validate() derived input/output channel counts from the ICC profile header (icGetSpaceSamples) rather than from the LUT tag's own stored values (m_nInput/m_nOutput), causing a mismatch that could lead to out-of-bounds heap memory access when iterating over curve arrays. The fix (commits 7c2cb71 and e91fe72) changes the validation logic to use the channel counts as read from the LUT tag itself, preventing crashes when processing malformed profiles with inconsistent channel counts (GitHub Commit 7c2cb71, GitHub Commit e91fe72). Exploitation requires a local attack vector and user interaction — specifically, a user must open or process a crafted ICC color profile file (GitHub Advisory).

Successful exploitation can result in application denial of service (crash) due to heap memory corruption, as well as potential information disclosure through memory leaks. Confidentiality impact is rated High (NVD) or Low (GitHub Advisory), while availability impact is rated High in both assessments, and integrity is unaffected. The attack is constrained to local access and requires user interaction, limiting the scope to systems where users process untrusted ICC color profiles using the iccDEV library (GitHub Advisory, Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Craft a malicious ICC profile: Create a specially crafted ICC color profile file containing a lut8 tag (AToB or BToA) with channel counts in the tag data that are inconsistent with the profile header's color space declarations, triggering the off-by-one or mismatched count condition in CIccTagLut8::Validate().
2. Deliver the malicious profile: Place the crafted .icc file in a location accessible to the target user (e.g., via email attachment, shared drive, or web download), since the attack vector is local and requires user interaction.
3. Trigger processing: Induce the target user to open or process the malicious ICC profile using an application that relies on the iccDEV library (e.g., a color management tool or image processing application).
4. Achieve impact: When CIccTagLut8::Validate() processes the malformed LUT tag, the mismatched channel count causes an out-of-bounds heap read/write, resulting in application crash (DoS) or potential memory disclosure (GitHub Advisory, GitHub Commit 7c2cb71).

• File System: Presence of unexpected or externally sourced .icc color profile files in user directories or temporary folders; ICC profiles with unusual or malformed LUT tag structures.
• Process: Unexpected crashes or abnormal termination of applications using the iccDEV library (e.g., color management tools, image processors) when opening ICC profile files; crash dumps referencing CIccTagLut8::Validate() or IccTagLut.cpp.
• Logs: Application error logs showing heap corruption errors, segmentation faults, or memory access violations originating from iccDEV library functions during ICC profile validation.

Update iccDEV to version 2.3.1.2 or later, which contains patches in commits 7c2cb71 and e91fe72 that fix the channel count mismatch in CIccTagLut8::Validate(), CIccTagLut16::Validate(), and CIccTagTextDescription (GitHub Advisory). No known workarounds are available for systems that cannot be patched immediately. As a risk-reduction measure, restrict processing of untrusted or externally sourced ICC color profiles and limit user access to applications utilizing the iccDEV library until patching is complete (Red Hat CVE).

The vulnerability was reported by security researcher xsscx and remediated by ChrisCoxArt in the iccDEV repository. Red Hat has acknowledged the CVE in their security tracking system. Community discussion has been limited, consistent with the moderate severity and niche impact of the library (GitHub Advisory, Red Hat CVE).