CVE-2026-21501: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21501 is a stack overflow vulnerability in the calculator parser component of iccDEV, a set of libraries and tools for interacting with and applying ICC color management profiles. The vulnerability was reported on December 29, 2025, patched on January 2, 2026, and publicly disclosed on January 7, 2026. All iccDEV versions prior to 2.3.1.2 are affected. The CVSS v3.1 base score is 7.8 (High) per NVD, while the GitHub Security Advisory rates it 5.5 (Moderate) with availability-only impact (GitHub Advisory, GitHub Issue).

The root cause is improper input validation (CWE-20) combined with an out-of-bounds write (CWE-787) in CIccMpeCalculator::Read() within IccProfLib/IccMpeCalc.cpp. When parsing sub-elements of a CIccMpeCalculator tag in a crafted ICC color profile, the code failed to validate that sub-element offsets did not reference back into the tag header or create circular references, allowing unbounded recursive calls to CIccMpeCalculator::Read() (up to 246 stack frames observed in the PoC). The fix added offset boundary checks — rejecting offsets less than headerSize or exceeding the available data size — and corrected the header size calculation to prevent the recursive condition (GitHub Commit 798be59, GitHub Commit f3056ed, GitHub Issue).

Successful exploitation causes a stack overflow that crashes the application processing the malicious ICC profile, resulting in a denial of service (DoS). The primary impact is on availability; the GitHub Security Advisory rates confidentiality and integrity impact as None, with only high availability impact. Any application or tool built on the iccDEV library that processes untrusted ICC color profiles is at risk of being crashed by a local attacker who can supply a crafted profile (GitHub Advisory).

A proof-of-concept ICC profile (CIccMpeCalculatorSetElem_StackOverflow_IccMpeCalc.cpp-L4963.icc) is publicly available via the issue report and can be used with the iccDumpProfile tool to reproduce the crash (GitHub Issue). Exploitation requires local access and user interaction (a user or process must open the malicious ICC profile), limiting the attack surface. There is no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.018% (very low probability of exploitation in the wild) (Feedly). This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Craft malicious ICC profile: Create or obtain a specially crafted ICC color profile containing a CIccMpeCalculator tag with sub-element offsets that reference back into the tag header or form circular references, triggering unbounded recursion during parsing.
2. Deliver the profile: Place the malicious .icc file in a location accessible to the target user or application (e.g., via email attachment, shared drive, or web download), since local access and user interaction are required.
3. Trigger parsing: Induce the target user or application to open or process the malicious ICC profile using an iccDEV-based tool (e.g., iccDumpProfile -v <malicious.icc>) or any application that uses the iccDEV library for color management.
4. Stack overflow occurs: The CIccMpeCalculator::Read() function recursively calls itself without bound (up to 246 frames observed), exhausting the stack and triggering an AddressSanitizer stack-overflow error or application crash.
5. Denial of service achieved: The target application aborts, resulting in a DoS condition for any process relying on the iccDEV library at the time of parsing (GitHub Issue).

• File System: Presence of unexpected or externally sourced .icc files, particularly those with unusual CIccMpeCalculator tag structures or abnormally large sub-element counts.
• Process: Application crashes or abnormal termination of processes using iccDEV libraries when processing ICC profiles; AddressSanitizer output containing stack-overflow in CIccMpeCalculator::SetElem() or CIccMpeCalculator::Read() at IccProfLib/IccMpeCalc.cpp.
• Logs: Crash reports or core dumps referencing deep call stacks (100+ frames) in CIccMpeCalculator::Read() at IccMpeCalc.cpp:4609; error messages from iccDumpProfile or similar tools indicating abnormal termination (GitHub Issue).

Upgrade all iccDEV installations to version 2.3.1.2 or later, which includes the fix introduced in commits 798be59 and f3056ed (GitHub Commit 798be59, GitHub Advisory). No official workarounds are provided by the maintainers. As an interim measure, restrict processing of ICC profiles to trusted sources only and limit access to systems running vulnerable iccDEV versions to trusted users.

The vulnerability was reported by security researcher xsscx and remediated by ChrisCoxArt (a contributor to the International Color Consortium project) via PR #413, merged on January 2, 2026 (GitHub PR). The issue was triaged and labeled as in-scope and security-relevant by maintainers. No significant broader media coverage or notable external researcher commentary has been identified beyond the GitHub issue and advisory.