CVE-2026-21674: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21674 is a memory leak vulnerability in iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The flaw exists in the XML MPE Parsing Path (iccFromXml) and specifically in the CIccProfileXml::ParseTag() error path, where allocated memory is not released upon parse failure. All versions prior to 2.3.1.1 are affected. The vulnerability was first reported on November 26, 2025, and publicly disclosed on January 6, 2026. It carries a CVSS v3.1 base score of 3.3 (Low) per the GitHub Security Advisory, though Feedly's NVD-sourced data rates it 5.5 (Medium) (GitHub Advisory, GitHub Issue).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In CIccProfileXml::ParseTag() within IccXML/IccLibXML/IccProfileXml.cpp, when XML tag parsing fails (e.g., due to an unrecognized or malformed element type), the function returns false without calling delete pTag on the previously allocated tag object. This results in direct leaks (e.g., 80 bytes from CIccTagXmlFactory::CreateTag()) and indirect leaks (e.g., 24 bytes from CIccTagXmlMultiProcessElement::ParseXml()), as confirmed by AddressSanitizer output. Exploitation requires a local attacker to supply a malicious XML file (e.g., a crafted ICC profile XML) to an application using the vulnerable iccFromXml tool or library (GitHub Advisory, GitHub Issue, Fix Commit).

Successful exploitation causes uncontrolled memory consumption in the affected application, potentially leading to application crashes and denial of service. The vulnerability has no impact on confidentiality or integrity — only availability is affected, and the scope is limited to the vulnerable component itself. The impact is most relevant to applications that process untrusted ICC profile XML files using the iccDEV library (GitHub Advisory).

A proof-of-concept is publicly available on GitHub (Issue #241), demonstrating the leak using the iccFromXml tool with a crafted CMYK-3DLUTs.xml file and AddressSanitizer instrumentation. There is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Issue).

1. Prepare a malicious XML file: Craft or obtain an ICC profile XML file (e.g., CMYK-3DLUTs.xml) that contains elements triggering parse failures in CIccProfileXml::ParseTag(), such as an unrecognized multiProcessElementType tag.
2. Target a vulnerable system: Identify a system running iccDEV version 2.3.1 or earlier where the iccFromXml tool or a dependent application processes user-supplied XML files.
3. Deliver the malicious file: Provide the crafted XML file to the target application — this requires user interaction (e.g., a user or automated process invoking iccFromXml CMYK-3DLUTs.xml output.icc).
4. Trigger the memory leak: The parser encounters the malformed element, logs errors such as Unable to Parse 'multiProcessElementType' Tag, and returns without freeing the allocated pTag object, leaking memory.
5. Achieve denial of service: Repeated processing of such files causes cumulative memory exhaustion, potentially crashing the application or degrading system performance (GitHub Issue, GitHub Advisory).

• Logs: Application logs showing repeated messages such as Unable to parse element of type CIccMpeXmlCurveSet, Unable to parse element of type CIccMpeXmlCalculator, Unable to Parse "multiProcessElementType" Tag, or Unable to Parse '<filename>.xml' — particularly when processing externally supplied XML files.
• Process Behavior: Abnormal memory growth in processes invoking iccFromXml or applications linked against iccDEV's XML parsing library; application crashes or out-of-memory errors following ICC profile XML processing.
• File System: Presence of unexpected or externally sourced ICC profile XML files (e.g., files with malformed multiProcessElementType elements) in directories processed by iccDEV-based tools (GitHub Issue).

Upgrade iccDEV to version 2.3.1.1 or later, which includes the fix introduced in commit d7028d8 (PR #246) that adds delete pTag in the relevant error paths of CIccProfileXml::ParseTag(). No official workarounds are provided by the vendor. As interim mitigations, restrict processing of XML files from untrusted sources, implement input validation before passing XML to iccDEV functions, and monitor applications for abnormal memory consumption (GitHub Advisory, Fix Commit).