CVE-2026-21500: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21500 is a stack overflow vulnerability in iccDEV's XML calculator macro expansion, affecting all versions prior to 2.3.1.2. iccDEV is an open-source library maintained by the International Color Consortium that provides tools for interacting with and applying ICC color management profiles. The vulnerability was reported on December 29, 2025, patched via PR #406 merged on January 2, 2026, and publicly disclosed on January 7, 2026. It carries a CVSS v3.1 base score of 5.5 (Moderate) per the official GitHub Security Advisory, though Feedly's NVD-sourced data assigns a higher score of 7.8 (High) reflecting broader impact estimates (GitHub Advisory, GitHub Issue).

The root cause is uncontrolled recursion (CWE-674) combined with improper input validation (CWE-20) and uncontrolled resource consumption (CWE-400) in the CIccMpeXmlCalculator::Flatten() function located at IccXML/IccLibXML/IccMpeXml.cpp. When processing XML-based ICC color profiles, the function recursively expands calculator macros without any depth limit or self-reference guard, allowing a crafted ICC profile containing a self-referencing or deeply nested macro to trigger infinite recursion and exhaust the call stack. The fix added a self-reference check: if the macro name being expanded matches the current macro context (name == macroName), the function now returns an error instead of recursing. A proof-of-concept XML file (stack-overflow-CIccMpeXmlCalculator-Flatten-poc.xml) and corresponding ICC file were provided in the issue report, with AddressSanitizer confirming the stack overflow at frame depth exceeding 246 recursive calls (GitHub Issue, Fix Commit).

Successful exploitation causes a denial of service via application crash or hang when the affected application processes a maliciously crafted ICC color profile. The primary impact is high availability loss; the official advisory rates confidentiality and integrity impacts as none, making this a DoS-only vulnerability in its base form. Any application or pipeline that ingests user-supplied ICC profiles using a vulnerable version of iccDEV is at risk, including image processing tools, color management utilities, and print workflows (GitHub Advisory).

A proof-of-concept exploit (crafted XML and ICC files) is publicly available in the GitHub issue report, submitted by researcher xsscx on December 29, 2025. Exploitation requires local access and user interaction — a victim must open or process the malicious ICC profile — which limits the attack surface. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term (GitHub Issue, Feedly).

1. Craft a malicious ICC profile: Create an XML-based ICC color profile (.xml or .icc) containing a calculator macro that references itself (self-referencing macro), triggering infinite recursion in CIccMpeXmlCalculator::Flatten(). A public PoC file (stack-overflow-CIccMpeXmlCalculator-Flatten-poc.xml) is available in the GitHub issue.
2. Deliver the file to the target: Social-engineer the victim into opening the crafted ICC profile with an application that uses a vulnerable version of iccDEV (any version prior to 2.3.1.2), such as an image editor or color management tool.
3. Trigger processing: The victim opens or imports the malicious ICC profile. The application invokes iccFromXml or equivalent iccDEV parsing routines, which call CIccMpeXmlCalculator::Flatten() on the embedded macro.
4. Stack overflow occurs: The function recurses without bound (observed at 246+ frames in the PoC), exhausting the process stack and causing the application to crash with a stack overflow error, resulting in denial of service (GitHub Issue, GitHub Advisory).

• File System: Presence of unexpected .xml or .icc files containing deeply nested or self-referencing calculator macro definitions in directories used for ICC profile processing.
• Logs: Application crash logs or core dumps referencing CIccMpeXmlCalculator::Flatten() in IccXML/IccLibXML/IccMpeXml.cpp; AddressSanitizer output with stack-overflow error at the same function.
• Process: Abnormal termination (SIGABRT, SIGSEGV) of applications that process ICC profiles; repeated application crashes when handling specific ICC or XML files from untrusted sources.
• System: Unusually high stack memory consumption by ICC profile processing applications prior to crash (GitHub Issue).

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix committed in cce5f9b and f295826 that adds a self-reference guard in CIccMpeXmlCalculator::Flatten(). As a temporary workaround prior to patching, the stack size can be limited using ulimit -s 4096 (setting a 4MB stack limit) to reduce the impact of the overflow. Additionally, restrict processing of ICC profiles from untrusted or unknown sources until the patch is applied (GitHub Advisory, Fix PR).

The vulnerability was reported by security researcher xsscx and remediated by contributor ChrisCoxArt (Adobe). The fix was reviewed and merged by the iccDEV maintainer within days of the report. A follow-up comment by contributor maxderhak suggested an alternative fix approach via modifying the initial ValidMacroCalls() invocation, and a subsequent commit in April 2026 added a more comprehensive recursion depth cap (kMaxFlattenDepth=256) as defense-in-depth for both XML and JSON calculator macro expansion paths (Fix PR).