CVE-2026-21675: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21675 is a Use-After-Free (UAF) vulnerability in iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The flaw exists in the CIccXform::Create() function within IccProfLib/IccCmm.cpp (line 823), where a hint manager object is improperly deleted after ownership has been transferred. All versions up to and including 2.3.1 are affected; the issue is fixed in version 2.3.1.1 (patched version 2.3.1.2 per the advisory). The vulnerability was first reported on October 27, 2025, and publicly disclosed on January 3–6, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Feedly).

The root cause is a Use-After-Free (CWE-416) combined with Improper Input Validation (CWE-20) in IccProfLib/IccCmm.cpp. In the icXformLutNamedColor case of CIccXform::Create(), a CIccCreateNamedColorXformHint object is allocated and added to the hint manager via pHintManager->AddHint(pNamedColorHint). The hint manager takes ownership of the object, but the code then incorrectly calls pHintManager->DeleteHint(pNamedColorHint), freeing memory that the hint manager still references. Subsequent operations using the now-freed pointer constitute the UAF condition. The fix (commit 510baf5) removes the erroneous DeleteHint call, matching the ownership pattern used elsewhere in the codebase (GitHub Issue #182, Fix Commit). The vulnerability is network-accessible, requires no authentication, and no user interaction, making it trivially exploitable in contexts where iccDEV processes remotely supplied ICC profiles.

Successful exploitation of this vulnerability can result in high-impact attacks against confidentiality, integrity, and availability of the affected system. An unauthenticated remote attacker can leverage the use-after-free condition to achieve arbitrary code execution, access sensitive data, or cause a denial of service by crashing the application. Any system or service that uses iccDEV to process ICC color profiles — including image processing pipelines, print management software, or color management tools — is at risk (GitHub Advisory, Feedly).

A proof-of-concept reference is publicly available via the GitHub issue tracker (GitHub Issue #182), though no weaponized exploit or exploit kit integration has been reported. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been made. The EPSS score is approximately 0.06%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report, though CISA referenced it in a weekly vulnerability bulletin (CISA Bulletin, Feedly).

1. Reconnaissance: Identify services or applications that use iccDEV versions ≤ 2.3.1 to process ICC color profiles, such as image processing servers, print management systems, or color management tools exposed over a network.
2. Craft malicious ICC profile: Create a specially crafted ICC color profile that triggers the icXformLutNamedColor code path within CIccXform::Create() in IccProfLib/IccCmm.cpp.
3. Trigger UAF condition: Submit the malicious ICC profile to the target application. The profile causes CIccCreateNamedColorXformHint to be allocated, added to the hint manager (which takes ownership), and then incorrectly freed via pHintManager->DeleteHint(pNamedColorHint) at line 825.
4. Exploit freed memory: After the hint object is freed, the hint manager retains a dangling pointer. By timing subsequent memory allocations (heap grooming), an attacker can reclaim the freed memory with attacker-controlled data.
5. Achieve code execution or crash: Operations on the dangling pointer using attacker-controlled memory content can redirect execution flow to arbitrary code, enabling remote code execution, or cause a crash resulting in denial of service (GitHub Issue #182, Fix Commit).

• Network: Unusual or malformed ICC profile data submitted to services processing color profiles; unexpected inbound connections delivering crafted .icc or .icm files to image/print processing endpoints.
• Process: Crashes or abnormal termination of processes linked to iccDEV (e.g., segmentation faults in applications using IccProfLib); unexpected child processes spawned by color management or image processing services.
• Logs: Application crash logs referencing IccCmm.cpp or CIccXform::Create(); heap corruption error messages or AddressSanitizer (ASan) reports mentioning use-after-free in IccProfLib.
• File System: Unexpected ICC profile files (.icc, .icm) in temporary directories or upload folders that do not correspond to legitimate user activity (GitHub Issue #182).

The vendor has released a fix in version 2.3.1.1 (patched version 2.3.1.2 per the GitHub advisory). The fix removes the erroneous pHintManager->DeleteHint(pNamedColorHint) call in IccProfLib/IccCmm.cpp, ensuring the hint manager retains proper ownership of the hint object. No workarounds are provided by the vendor — upgrading to version 2.3.1.1 or later is the only recommended remediation. Organizations should audit their software inventory for any applications embedding iccDEV ≤ 2.3.1 and prioritize patching given the critical CVSS score and network-accessible attack vector (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher xsscx and remediated by ChrisCoxArt (the fix commit author). The disclosure was covered by The Hacker Wire on Mastodon and Bluesky, and referenced in CISA's weekly vulnerability bulletin for the week of January 5, 2026. Community reaction has been limited given the specialized nature of the iccDEV library, but the critical CVSS score drew attention from automated vulnerability tracking platforms including VulnDB, Vulners, and CIRCL (CISA Bulletin, The Hacker Wire).