CVE-2026-21506: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21506 is a null pointer dereference vulnerability in the iccDEV library's CIccProfileXml::ParseBasic() function that leads to denial of service. It affects all iccDEV versions prior to 2.3.1.2, a set of libraries and tools maintained by the International Color Consortium for interacting with ICC color management profiles. The vulnerability was reported on December 29, 2025, patched via commit on January 2, 2026, and publicly disclosed on January 7, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) leading to a null pointer dereference (CWE-476) in CIccProfileXml::ParseBasic() located at IccXML/IccLibXML/IccProfileXml.cpp:477:46. Specifically, the code dereferences pNode->children->content for the ProfileVersion and ProfileSubClassVersion XML elements without first checking whether pNode->children is NULL, which occurs when a malformed XML ICC profile omits the expected child node values. An attacker can trigger this by supplying a crafted XML file (e.g., via the iccFromXml command-line tool) that contains empty ProfileVersion or ProfileSubClassVersion elements. The fix (commit f2ea323) adds null checks for pNode->children before dereferencing, emitting a parse error string and continuing rather than crashing (GitHub Issue #371, Fix Commit).

Successful exploitation causes the application parsing the malformed ICC profile to crash, resulting in a denial of service. The impact is limited to availability — there is no confidentiality or integrity impact, and no lateral movement or data exfiltration risk is associated with this vulnerability. The attack is local in scope and requires user interaction (e.g., a user or process must open a crafted ICC XML profile), limiting the blast radius to the affected application instance (GitHub Advisory, Feedly).

A proof-of-concept demonstrating the crash is publicly available in the GitHub issue tracker, showing AddressSanitizer output confirming the SEGV on a null address read in CIccProfileXml::ParseBasic() (GitHub Issue #371). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.013% (0.000130), reflecting very low probability of exploitation in the near term (Feedly).

1. Craft a malicious ICC XML profile: Create an XML file representing an ICC color profile where the ProfileVersion or ProfileSubClassVersion element has no child text node (i.e., the element is empty, such as <ProfileVersion></ProfileVersion>).
2. Deliver the file to the target: Place the crafted XML file in a location accessible to the target user or process running an iccDEV-based application (e.g., iccFromXml).
3. Trigger parsing: Induce the target to process the file, for example by running iccFromXml foobar.xml foobar.icc or by having an application that automatically parses ICC profiles open the file.
4. Achieve denial of service: The CIccProfileXml::ParseBasic() function dereferences pNode->children->content without a null check, causing a segmentation fault (SEGV on address 0x50) and crashing the application (GitHub Issue #371, GitHub Advisory).

• Process: Unexpected crash or segmentation fault of any application using the iccDEV library, particularly processes invoking iccFromXml or similar ICC profile parsing tools.
• Logs: AddressSanitizer or system crash logs referencing CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cpp:477; error messages such as SEGV on unknown address 0x000000000050.
• File System: Presence of malformed ICC XML files with empty <ProfileVersion> or <ProfileSubClassVersion> elements in directories processed by iccDEV-based applications (GitHub Issue #371).

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix introduced in commit f2ea323 (PR #418) that adds null checks for pNode->children before dereferencing in CIccProfileXml::ParseBasic(). No official workarounds are provided by the maintainers. As a defense-in-depth measure, restrict local access to systems running iccDEV and avoid processing untrusted ICC XML profile files until the patch is applied (GitHub Advisory, Fix Commit).