CVE-2026-21673: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21673 is an integer overflow/underflow vulnerability in the CIccXmlArrayType::ParseTextCountNum() function of the iccDEV library, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The vulnerability affects iccDEV versions prior to 2.3.1.1 and was discovered through fuzzing by ChrisCoxArt, reported on November 26, 2025, and publicly disclosed on January 6, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is improper numeric type conversion in IccUtilXml.cpp at line 1018, where atof() output is directly cast to unsigned int without range validation, triggering undefined behavior when the floating-point value is negative, infinite, or exceeds the representable range of the target type (CWE-190, CWE-681, CWE-704) (GitHub Issue). The attack vector is local: an attacker must supply a crafted malicious ICC XML color profile (e.g., via IccFromXML) that contains out-of-range numeric values in array fields, causing the overflow or underflow when parsed. UndefinedBehaviorSanitizer (UBSan) reports confirm values such as -40, -368, inf, and 3.3e+35 being cast to unsigned int, all of which are outside the representable range (GitHub Issue). The fix introduces a clipTypeRange<T, F>() template function that clamps input values to the valid output type range before casting, and flushes NaN to zero (GitHub Commit).

Successful exploitation can result in memory corruption due to integer overflow or underflow, with high impact on confidentiality (unauthorized information disclosure), integrity (unauthorized data modification), and availability (crashes or denial of service) (GitHub Advisory). The vulnerability affects any application or pipeline that uses the iccDEV library to process ICC color profiles from untrusted sources, such as image processing tools, print workflows, or color management systems. Lateral movement potential is limited given the local attack vector, but exploitation in a shared processing environment could affect other users or services relying on the same library instance.

A proof-of-concept is publicly available via the GitHub issue tracker, consisting of sample malformed ICC XML files that trigger the undefined behavior (GitHub Issue). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term (Feedly). Exploitation requires user interaction — a user must open or process a crafted ICC profile — which further limits the attack surface.

1. Craft a malicious ICC XML profile: Create or modify an ICC XML color profile (.xml) to include out-of-range numeric values in array fields — such as negative numbers (e.g., -40, -368), very large floating-point values (e.g., 3.3e+35, 1.84e+185), or special values like inf or NaN — that will be parsed by CIccXmlArrayType::ParseTextCountNum() (GitHub Issue).
2. Deliver the malicious profile: Place the crafted .xml file in a location accessible to the target user or system, such as a shared directory, email attachment, or web download, relying on user interaction to trigger processing.
3. Trigger parsing: Cause the target application using the vulnerable iccDEV library to process the malicious profile, for example by running IccFromXML malicious.xml out.icc or through any application that invokes CIccXmlArrayType::ParseText() internally (GitHub Issue).
4. Trigger overflow/underflow: The atof() result for the out-of-range value is cast directly to unsigned int at IccUtilXml.cpp:1018, producing undefined behavior and potential memory corruption (GitHub Commit).
5. Achieve impact: Depending on memory layout and platform, the corruption may result in a crash (denial of service), information disclosure from adjacent memory, or potentially arbitrary code execution.

• File System: Presence of unexpected or externally sourced ICC XML profile files (.xml) in directories processed by iccDEV-based tools; sample filenames from the PoC include patterns like sRGB_D65_colorimetric_*.xml (GitHub Issue).
• Process: Application crashes or abnormal termination of processes invoking IccFromXML or other iccDEV-based tools when processing ICC profiles from untrusted sources.
• Logs: UndefinedBehaviorSanitizer (UBSan) runtime error messages referencing IccUtilXml.cpp:1018 with messages such as runtime error: <value> is outside the range of representable values of type 'unsigned int' (GitHub Issue).
• Network: Unexpected downloads or transfers of .xml ICC profile files from external or untrusted sources to systems running iccDEV.

The vendor has released a fix in iccDEV version 2.3.1.1 (patched version 2.3.1.2 per the advisory), available via the official InternationalColorConsortium GitHub repository at commit 3274080 (GitHub Commit). No workarounds are provided by the vendor; upgrading to the patched version is the recommended remediation (GitHub Advisory). As an interim measure, organizations should restrict processing of ICC profiles from untrusted or external sources and monitor for unexpected application crashes related to ICC profile parsing.

The vulnerability was noted in CISA's weekly vulnerability bulletin for the week of January 5, 2026, and received coverage from security aggregators including RedPacket Security and Vulners. Social media mentions appeared on Mastodon and Bluesky via TheHackerWire, indicating moderate community awareness. No significant vendor statements beyond the GitHub security advisory or notable independent researcher commentary have been identified.