CVE-2026-21502: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21502 is a NULL pointer dereference vulnerability in the iccDEV library's XML tag parser that allows a local attacker to crash applications processing malicious ICC color profiles. iccDEV, maintained by the International Color Consortium, provides libraries and tools for interacting with ICC color management profiles. All versions prior to 2.3.1.2 are affected; the issue was reported on December 29, 2025, patched on January 2, 2026, and publicly disclosed on January 7, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is improper input validation and an unchecked return value in CIccTagXmlFixedNum<>::ParseXml() within IccXML/IccLibXML/IccTagXml.cpp (CWE-20, CWE-252, CWE-476, CWE-690). Specifically, after calling icXmlFindNode(pNode, "Array"), the code immediately dereferences pNode->children without first checking whether icXmlFindNode returned NULL — a condition that occurs when the expected <Array> XML element is absent in a crafted ICC profile file. The fix (commit d04c236) adds a NULL check before the dereference, returning false if pNode is NULL. Exploitation requires user interaction: the victim must open or process a specially crafted XML-based ICC profile file using an application built on the vulnerable iccDEV library (GitHub Issue #368, Fix Commit).

Successful exploitation causes a NULL pointer dereference (SEGV) in the application processing the malicious ICC profile, resulting in an application crash and denial of service. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Applications embedding the iccDEV library for ICC profile processing (e.g., color management tools, image editors, print workflows) are at risk of being crashed by a local or socially-engineered attacker supplying a crafted profile file (GitHub Advisory).

A proof-of-concept (PoC) exploit — consisting of a crafted XML ICC profile file (SegFault-IccTagXml_CIccTagXmlFixedNum_L1273.xml) — is publicly available in the GitHub issue tracker. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. No threat actor attribution has been reported (GitHub Issue #368, Feedly).

1. Craft a malicious ICC profile: Create an XML-based ICC profile file that includes a fixed-number array tag (e.g., s15Fixed16ArrayType) where the <Array> child element is absent or malformed, causing icXmlFindNode() to return NULL.
2. Deliver the file to the victim: Place the crafted .xml or .icc file in a location accessible to the target user (e.g., shared folder, email attachment, download), since local access and user interaction are required.
3. Trigger processing: Induce the victim to open the file with an application that uses the vulnerable iccDEV library — for example, by running iccFromXml SegFault-IccTagXml_CIccTagXmlFixedNum_L1273.xml output.icc.
4. Achieve denial of service: The application calls CIccTagXmlFixedNum::ParseXml() → CIccProfileXml::ParseTag() → CIccProfileXml::ParseXml(), dereferences the NULL pNode->children pointer at IccTagXml.cpp:1282, and crashes with a SIGSEGV (GitHub Issue #368, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .xml or .icc files containing s15Fixed16ArrayType or similar fixed-number array tags with missing <Array> child elements.
• Process: Application crash (SIGSEGV/abort) originating from processes that invoke iccFromXml or any application linked against the iccDEV library when processing ICC profile files.
• Logs: Crash reports or core dumps referencing CIccTagXmlFixedNum::ParseXml at IccTagXml.cpp:1282, CIccProfileXml::ParseTag at IccProfileXml.cpp:736, or AddressSanitizer/UBSan output indicating a NULL pointer dereference in the iccDEV XML parsing stack (GitHub Issue #368).

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix introduced in commits d04c236 and d9e42a1 (merged via PR #407 on January 2, 2026). No official workarounds are provided by the maintainers. As a defense-in-depth measure, restrict which users and processes are permitted to load ICC profile files, and validate or sanitize ICC profile inputs before passing them to the library (GitHub Advisory, Fix PR #407).