CVE-2026-21679: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21679 is a heap buffer overflow vulnerability in the CIccLocalizedUnicode::GetText() function of iccDEV, a library and toolset for interacting with ICC color management profiles maintained by the International Color Consortium. The vulnerability affects all iccDEV versions prior to 2.3.1.2 and was discovered via LibFuzzer fuzzing on December 19, 2025, with the fix merged on December 20, 2025, and the CVE published on January 7, 2026. The GitHub Security Advisory (GHSA-h4wg-473g-p5wc) assigns a CVSS v3.1 score of 8.8 (High) with user interaction required, while NVD's estimate rates it 9.8 (Critical) without user interaction (GitHub Advisory, GitHub Issue).

The root cause is improper input validation (CWE-20) and an out-of-bounds write (CWE-787) in IccProfLib/IccTagBasic.cpp at line 7131. The GetText() function iterated over a UTF-16 buffer using a null-terminator check (while (*str)) without validating the pointer against the allocated buffer length, allowing a read beyond the heap-allocated region when processing a malformed or malicious ICC color profile. Additionally, the copy constructor CIccLocalizedUnicode(const CIccLocalizedUnicode&) allocated only (m_nLength+1) elements instead of (m_nLength+2), leaving insufficient space for the null terminator. The fix adds a bounds check (str < str_end) in the loop, allocates an extra element for safety, and validates tag read lengths against expected lengths to prevent processing of truncated or oversized tag data (GitHub Issue, GitHub Commit).

Successful exploitation can result in remote code execution, denial of service (application crash), or information disclosure, depending on how the heap overflow is leveraged. The vulnerability is triggered when an application using the iccDEV library processes a specially crafted ICC color profile — for example, one claiming a very large tag data size that is not fully read — causing the library to read beyond the allocated heap buffer. Systems that process ICC profiles from untrusted sources (e.g., image processing pipelines, color management services) are at risk of compromise (GitHub Advisory, GitHub Issue).

A proof-of-concept crash artifact was generated by LibFuzzer during discovery and referenced in the GitHub issue (crash file crash-e9f9a1a3a8876397062e227fa0c265b727a3536c), though a fully weaponized exploit has not been publicly released. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.056% (0.000560), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Issue, GitHub Advisory).

1. Craft a malicious ICC profile: Create a specially crafted ICC color profile file containing a MultiLocalizedUnicode tag with a malformed or oversized UTF-16 string — for example, a tag that claims a very large data length (e.g., 1.6 GB) but contains only a small amount of actual data, or a UTF-16 string lacking a proper null terminator.
2. Deliver the profile to the target: Distribute the malicious .icc file via email attachment, web upload, or any channel where the target application processes ICC profiles from external sources. User interaction (opening or processing the file) is required per the official advisory.
3. Trigger profile parsing: The target application calls iccDEV's CIccProfile::FindTag() → CIccTagMultiLocalizedUnicode::Read() → CIccLocalizedUnicode::CIccLocalizedUnicode() (copy constructor), which allocates a heap buffer of insufficient size.
4. Trigger the overflow: When CIccTagMultiLocalizedUnicode::Describe() calls CIccLocalizedUnicode::GetText(), the function iterates past the end of the allocated buffer (a 2-byte READ beyond a 92-byte region), triggering the heap buffer overflow.
5. Achieve impact: Depending on heap layout and exploitation technique, the attacker may cause a crash (DoS), leak heap memory contents (information disclosure), or potentially achieve code execution by corrupting adjacent heap metadata or function pointers (GitHub Issue, GitHub Commit).

• File System: Presence of unexpected or externally sourced .icc ICC color profile files in application input directories or temporary folders; crash dump files (e.g., crash-* artifacts) in application working directories.
• Process: Abnormal termination (crash/segfault) of applications using the iccDEV library when processing ICC profiles; AddressSanitizer output referencing CIccLocalizedUnicode::GetText() in IccProfLib/IccTagBasic.cpp:7131.
• Logs: Application error logs showing heap corruption errors, SIGABRT, or SIGSEGV signals originating from iccDEV library calls; log entries referencing CIccProfile::LoadTag or CIccTagMultiLocalizedUnicode::Read at the time of crash.
• Network: Unexpected inbound delivery of .icc files via email, HTTP upload endpoints, or file-sharing services to systems running vulnerable iccDEV versions (GitHub Issue).

The vulnerability is patched in iccDEV version 2.3.1.2, released December 20, 2025. Users should upgrade to version 2.3.1.2 or later immediately. No official workarounds are provided by the maintainers; as an interim measure, restrict processing of ICC color profiles from untrusted or external sources, and avoid exposing iccDEV-based services to untrusted input until patched. The fix is available via commit 2eb25ab and pull request #329 (GitHub Advisory, GitHub Commit).

The vulnerability received brief coverage from The Hacker Wire, which published a post titled "iccDEV Heap Overflow in CIccLocalizedUnicode::GetText" shortly after disclosure (The Hacker Wire). The CISA weekly vulnerability bulletin for the week of January 5, 2026 included this CVE (CISA Bulletin). Community reaction has been limited, consistent with the low EPSS score and absence of active exploitation.