CVE-2026-21503: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21503 is a null pointer dereference vulnerability in the iccDEV library (International Color Consortium) that causes undefined behavior when a null pointer is passed to memcpy() in the CIccTagSparseMatrixArray component. It affects all versions of iccDEV prior to 2.3.1.2 and was reported on December 29, 2025, with a fix merged on January 2, 2026, and the advisory published on January 7, 2026. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) per the GitHub Security Advisory, or 5.5 (Medium) per NVD (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) combined with an incorrect buffer size calculation (CWE-131) and a null pointer dereference (CWE-476) in IccProfLib/IccTagBasic.cpp at line 4474. Specifically, the CIccTagSparseMatrixArray::Read() method failed to reject ICC profile tags with zero matrix count or zero channel count, allowing a crafted ICC profile to trigger a calloc() that returns a null pointer, which is then passed directly to memcpy() — invoking undefined behavior. The fix adds an early rejection check (if (nNumMatrices < 1 || nChannels < 1) return false;) and corrects the copy operator to use GetBytesPerMatrix() instead of m_nChannelsPerMatrix for proper allocation (GitHub Issue #367, Patch Commit). Exploitation requires local access and user interaction — a victim must open a maliciously crafted ICC color profile file (GitHub Advisory).

Successful exploitation causes the application processing the malicious ICC profile to crash due to undefined behavior from the null pointer passed to memcpy(), resulting in a denial of service. Additionally, the undefined behavior could potentially lead to data corruption, and the advisory notes a low integrity impact alongside high availability impact. There is no confidentiality impact, and the vulnerability scope is unchanged, limiting blast radius to the affected process (GitHub Advisory, Feedly).

A proof-of-concept is publicly available as a crafted ICC profile file (DoubleFree_IccUtil.cpp-L121.icc) hosted on GitHub, which reproducibly triggers the undefined behavior when processed by the iccRoundTrip tool (GitHub Issue #367). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.017% (0.000170), indicating very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

1. Craft or obtain a malicious ICC profile: Obtain or create a specially crafted ICC color profile file with a CIccTagSparseMatrixArray tag containing zero matrix count or zero channel count values. A public PoC file (DoubleFree_IccUtil.cpp-L121.icc) is available at the reporter's GitHub repository.
2. Deliver the file to the target: Distribute the malicious .icc file to a target user via email attachment, file share, or web download, relying on social engineering to prompt the user to open it.
3. Trigger processing: The victim opens the ICC profile using an application that links against the vulnerable iccDEV library (e.g., running iccRoundTrip DoubleFree_IccUtil.cpp-L121.icc).
4. Trigger null pointer dereference: The CIccTagSparseMatrixArray::Read() method processes the tag without validating zero counts, causing calloc() to return null, which is then passed to memcpy() at IccProfLib/IccTagBasic.cpp:4474.
5. Achieve denial of service: The application crashes with a UndefinedBehaviorSanitizer error (runtime error: null pointer passed as argument 2), causing denial of service and potentially data corruption (GitHub Issue #367, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .icc files, particularly those with unusual or minimal tag structures in directories accessible to users or applications.
• Logs: Application crash logs or core dumps referencing IccProfLib/IccTagBasic.cpp:4474; UndefinedBehaviorSanitizer output containing runtime error: null pointer passed as argument 2, which is declared to never be null and SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior IccProfLib/IccTagBasic.cpp:4474:21.
• Process: Unexpected termination of applications that process ICC color profiles (e.g., iccRoundTrip, image editors, or color management tools) when opening user-supplied files (GitHub Issue #367).

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix introduced in commit 55259a6 (PR #417) that adds input validation to reject ICC tags with zero matrix count or zero channel count, and corrects the copy operator's buffer allocation (Patch Commit, GitHub Advisory). No official workaround is provided by the maintainers; however, users should avoid opening ICC color profiles from untrusted or unknown sources until patching is complete. Where feasible, implement controls to restrict which ICC profile files can be processed by applications using the iccDEV library.

The vulnerability was discovered and reported by security researcher xsscx on December 29, 2025, with the fix developed by ChrisCoxArt (a project contributor) and merged on January 2, 2026 (GitHub PR #417). The issue was triaged and labeled as in-scope and security-relevant by maintainers promptly. No significant broader media coverage or notable community commentary beyond the GitHub issue and advisory has been identified.