CVE-2026-21495: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21495 is a division by zero vulnerability in the TIFF Image Reader component of iccDEV, a library and toolset maintained by the International Color Consortium for ICC color management profile interaction and manipulation. All versions of iccDEV prior to 2.3.1.2 are affected. The vulnerability was published on January 7, 2026, with the fix committed on January 9, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is improper input validation (CWE-20) in the TiffImg.cpp file within the CTiffImg::Open() and CTiffImg::ReadLine() functions, leading to a divide-by-zero condition (CWE-369) when processing malformed TIFF image files. Specifically, the code failed to check whether critical TIFF parameters — m_nRowsPerStrip, m_nSamples, and m_nBitsPerSample — were zero before using them in arithmetic operations. The fix (commit 10c3417) adds explicit zero-value checks for these parameters and returns an error if corrupt values are detected, preventing the division from occurring (GitHub Commit, GitHub Advisory). Exploitation requires local access and user interaction — specifically, a user must open or process a crafted malicious TIFF file using the iccDEV toolset.

Successful exploitation causes an application crash, resulting in a denial of service (DoS) condition. There is no impact to data confidentiality or integrity — only availability is affected. The scope is limited to the iccDEV process itself, with no evidence of lateral movement potential or data exposure risk (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.019%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction, significantly limiting the attack surface (GitHub Advisory).

Users should upgrade iccDEV to version 2.3.1.2 or later, which includes the fix introduced in commit 10c3417. No official workarounds are provided by the vendor. As interim measures, organizations should restrict processing of TIFF files from untrusted sources and limit access to iccDEV tools to trusted users only (GitHub Advisory, GitHub Commit).