CVE-2026-21496: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21496 is a NULL pointer dereference vulnerability in the iccDEV library's signature parser that can cause a denial of service via application crash. iccDEV, maintained by the International Color Consortium, provides libraries and tools for interacting with ICC color management profiles. All versions prior to 2.3.1.2 are affected; the issue was reported on December 29, 2025, patched on January 2, 2026, and publicly disclosed on January 7, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is improper input validation (CWE-20) combined with an unchecked return value leading to a NULL pointer dereference (CWE-476, CWE-690) in the icGetSigVal() function located at IccProfLib/IccUtil.cpp:1277. When parsing a maliciously crafted XML-based ICC profile containing a malformed <Signature> element (e.g., >Signature>:>>>>0), the function receives a NULL pointer and passes it directly to strlen() without validation, triggering a segmentation fault. The vulnerability was introduced with the initial implementation of icGetSigVal() and affects the iccFromXml tool and any application using the CIccProfileXml::ParseTag() code path. A proof-of-concept reproducer was published in the issue report (GitHub Issue, GitHub Advisory).

Successful exploitation results in an application crash (denial of service), causing unavailability of any process that parses the malicious ICC profile. There is no impact on confidentiality or data integrity — the vulnerability cannot be used to execute arbitrary code or access sensitive information. The scope is limited to the affected application instance; lateral movement or data exfiltration are not possible through this vulnerability alone (GitHub Advisory).

A proof-of-concept is publicly available as a GitHub issue report, demonstrating the crash with a minimal malformed XML ICC profile (GitHub Issue). Exploitation requires local access and user interaction — a victim must open or process a crafted ICC profile file. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term (Feedly).

1. Craft a malicious ICC XML profile: Create an XML file containing a malformed <Signature> element with an invalid or empty value, such as >Signature>:>>>>0, which causes the parser to pass a NULL pointer to icGetSigVal().
2. Deliver the file to the target: Social-engineer a user into opening the crafted .xml file with the iccFromXml tool or any application that uses the iccDEV library to parse ICC profiles (e.g., iccFromXml foo.xml bar.icc).
3. Trigger the NULL pointer dereference: When the application processes the <Signature> tag via CIccProfileXml::ParseTag(), it calls icGetSigVal() with a NULL buffer, which then passes the NULL pointer to strlen() at IccProfLib/IccUtil.cpp:1277.
4. Application crash: The process receives a SIGSEGV signal and terminates, resulting in denial of service for the affected application (GitHub Issue, GitHub Advisory).

• Logs: Application crash logs or core dumps referencing icGetSigVal() in IccProfLib/IccUtil.cpp or __strlen_evex in the stack trace; AddressSanitizer output showing SEGV on unknown address 0x000000000000.
• File System: Presence of unexpected or externally sourced .xml ICC profile files with malformed <Signature> elements (e.g., containing >Signature>:>>>>0 patterns).
• Process: Abnormal termination (SIGSEGV/segmentation fault) of iccFromXml or any process loading the iccDEV library during ICC profile parsing operations (GitHub Issue).

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix introduced in commits 0e51ceb and b5ad23a — adding a NULL check in icGetSigVal() before dereferencing the pointer (GitHub Patch Commit). No official workaround is provided for unpatched versions; as an interim measure, restrict processing of ICC profiles from untrusted or unknown sources and educate users not to open ICC profile files from unverified origins. Monitor for application crashes related to signature parsing as a potential indicator of exploitation attempts (GitHub Advisory).