CVE-2026-21497: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21497 is a NULL Pointer Dereference vulnerability in iccDEV, an open-source library and toolset maintained by the International Color Consortium for interacting with and manipulating ICC color management profiles. The flaw exists in all versions prior to 2.3.1.2 and was reported on December 29, 2025, with a patch merged on January 1, 2026, and the CVE published on January 7, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The vulnerability is rooted in improper input validation (CWE-20) and an unchecked return value (CWE-252) leading to a NULL pointer dereference (CWE-476) in the CIccTagXmlUnknown::ParseXml() function located at IccXML/IccLibXML/IccTagXml.cpp:98:47. Specifically, the function dereferences the pNode pointer without first verifying it is non-NULL, which can be triggered when parsing a maliciously crafted ICC XML profile containing an unknown tag. The fix, introduced in commit 9419cac, adds a NULL check for pNode before dereferencing it while allowing other parsing to continue (GitHub Issue, Fix Commit). A proof-of-concept XML file (poc.xml) and reproduction steps were publicly disclosed in the issue report (GitHub Issue).

Successful exploitation causes a denial of service via application crash (SEGV/segmentation fault) in any application using the vulnerable iccDEV library to process ICC color profiles. There is no impact on confidentiality or integrity — only availability is affected. The attack is limited in scope to the vulnerable application process and does not enable lateral movement or data exfiltration (GitHub Advisory).

A proof-of-concept exploit (malicious poc.xml ICC profile) is publicly available in the GitHub issue tracker, demonstrating reliable crash reproduction via AddressSanitizer-detected SEGV (GitHub Issue). Exploitation requires local access and user interaction — a victim must open or process the malicious ICC profile with an affected application. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.017% (very low probability of exploitation in the near term) (Feedly).

1. Craft malicious ICC XML profile: Create a specially crafted XML-based ICC color profile (poc.xml) that includes an unknown tag element structured to cause pNode to be NULL when parsed by CIccTagXmlUnknown::ParseXml().
2. Deliver the file: Deliver the malicious poc.xml to the target system via social engineering, file sharing, or any mechanism that causes the victim to open or process the file with an iccDEV-based application (e.g., iccFromXml).
3. Trigger parsing: The victim runs or an application automatically invokes iccFromXml poc.xml poc.icc or equivalent, causing the vulnerable CIccTagXmlUnknown::ParseXml() function to be called.
4. NULL pointer dereference: The function attempts to dereference pNode->parent at IccTagXml.cpp:98 without a NULL check, triggering a SEGV and crashing the application (GitHub Issue).

• File System: Presence of unexpected or externally sourced .xml ICC profile files (e.g., poc.xml) in directories processed by iccDEV-based applications.
• Logs: Application crash logs or core dumps referencing CIccTagXmlUnknown::ParseXml() at IccXML/IccLibXML/IccTagXml.cpp:98; AddressSanitizer output showing SEGV on unknown address 0x000000000028 with stack trace involving iccFromXml or related tools.
• Process: Unexpected termination (SIGABRT/SIGSEGV) of applications using the iccDEV library when processing ICC profile files (GitHub Issue).

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix introduced in commit 9419cac (merged via PR #403 on January 1, 2026). No official workarounds are provided by the maintainers. As an interim measure, restrict user or application ability to process ICC profiles from untrusted or external sources until patching is complete (GitHub Advisory, Fix PR).

The vulnerability was reported and triaged entirely within the iccDEV GitHub repository by researcher xsscx, with the fix contributed by maintainer ChrisCoxArt. No significant broader media coverage, vendor statements beyond the GitHub advisory, or notable community commentary have been identified for this moderate-severity, limited-scope vulnerability (GitHub Advisory).