CVE-2026-21505: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21505 is an Undefined Behavior (UB) vulnerability caused by an invalid enum value in the iccDEV library, a set of libraries and tools for interacting with ICC color management profiles maintained by the International Color Consortium. The vulnerability affects iccDEV versions prior to 2.3.1.2 and was discovered on December 27, 2025, with the fix merged on January 2, 2026, and the CVE published on January 7, 2026 (GitHub Advisory). The official GitHub Security Advisory assigns a CVSS v3.1 score of 5.5 (Medium), with availability impact only, while Feedly's NVD-sourced data reflects a higher score of 7.8 (High) that includes confidentiality and integrity impacts (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) combined with type confusion (CWE-843) in the icMaterialColorSignature enum definition within IccProfLib/icProfileHeader.h. When a malformed or malicious ICC color profile file contains an invalid material color signature value (e.g., 0x85580000 / decimal 2240086016), the code in wxProfileDump/wxProfileDump.cpp (lines 551, 591, 592) and IccProfLib/IccProfile.cpp (line 1492) loads this value into the icMaterialColorSignature enum type, triggering undefined behavior as detected by UndefinedBehaviorSanitizer (GitHub Issue). The fix added an explicit underlying type (icUInt32Number) and sentinel values (icSigMCSDataEnd, icSigMCSMaxEnumData) to the enum to give it a well-defined range, eliminating the UB (Fix Commit). The attack vector is local, requiring user interaction (opening a crafted ICC profile file), with no privileges required.

The primary impact is a denial of service through application crash or instability when processing a maliciously crafted ICC color profile file. Any application or system using the iccDEV libraries — including the wxProfileDump tool and IccDumpProfile command-line utility — to process color profiles is potentially affected. The official advisory rates the availability impact as High with no confidentiality or integrity impact, meaning the vulnerability does not expose sensitive data or allow unauthorized modification of data (GitHub Advisory).

A proof-of-concept exploit (a crafted ICC profile file, IccCmm_cpp-L8840.icc.txt) is publicly available on GitHub and was used to reproduce the issue (GitHub Issue). There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Feedly).

1. Craft or obtain a malicious ICC profile: Prepare or download a malformed ICC color profile file containing an invalid icMaterialColorSignature value (e.g., 0x85580000). A public test case (IccCmm_cpp-L8840.icc.txt) is available via the GitHub issue report.
2. Deliver the file to the target: Social-engineer a user into opening the malicious ICC profile file with a vulnerable application that uses the iccDEV library (e.g., wxProfileDump or iccDumpProfile).
3. Trigger undefined behavior: When the application parses the ICC profile, the invalid enum value is loaded into the icMaterialColorSignature type at wxProfileDump.cpp:551, triggering undefined behavior in the C++ runtime.
4. Achieve denial of service: The undefined behavior causes application crash or instability, resulting in a denial of service for the affected tool or any application embedding the iccDEV library (GitHub Issue, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .icc profile files in directories accessible to iccDEV-based tools; specifically files with anomalous icMaterialColorSignature field values (e.g., 0x85580000).
• Logs: UndefinedBehaviorSanitizer (UBSan) runtime error messages referencing wxProfileDump/wxProfileDump.cpp:551, :591, :592, or IccProfLib/IccProfile.cpp:1492 with the message load of value 2240086016, which is not a valid value for type 'icMaterialColorSignature'.
• Process: Unexpected crashes or abnormal termination of iccDumpProfileGui, iccDumpProfile, or other iccDEV-based applications shortly after opening an ICC profile file (GitHub Issue).

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix merged via PR #419 on January 2, 2026 (GitHub PR, Fix Commit). No official workarounds are provided by the maintainers. As interim mitigations, organizations should restrict processing of ICC color profiles from untrusted or external sources, and consider sandboxing applications that use the iccDEV library to limit the impact of potential crashes (GitHub Advisory).