CVE-2026-21680: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21680 is a NULL pointer dereference vulnerability in the CIccProfile::CheckTagTypes() function of the iccDEV library, a set of tools for interacting with International Color Consortium (ICC) color management profiles. The vulnerability was discovered via libFuzzer with MemorySanitizer on December 19, 2025, and publicly disclosed on January 7, 2026. It affects all iccDEV versions prior to 2.3.1.2. The CVSS v3.1 base score is 6.5 (Medium) per the GitHub Security Advisory, with user interaction required (GitHub Advisory).

The root cause is a missing NULL pointer check (CWE-476) in CIccProfile::CheckTagTypes() within IccProfLib/IccProfile.cpp at line 1978, where the code dereferences i->pTag (via calls to GetType(), GetTagStructType(), and GetTagArrayType()) without first verifying that pTag is non-NULL. The vulnerability is triggered when a malformed ICC color profile is processed, causing the tag validation logic to attempt a read at address 0x0, resulting in a segmentation fault. The crash was discovered using libFuzzer with an empty corpus, approximately 21,355 executions, and a maximum input length of 4096 bytes, with the crashing input being a crafted ICC profile file (GitHub Issue #322, GitHub Advisory). The fix added NULL checks for pTag before dereferencing in DeleteTag(), CheckTagTypes(), and Validate(), and also added a NULL check for the m_Tags container pointer (GitHub PR #325).

Successful exploitation causes a denial of service by crashing any application that uses the iccDEV library to process a maliciously crafted ICC color profile. There is no impact on confidentiality or data integrity — the sole consequence is high availability impact, as the affected application terminates unexpectedly. Applications relying on iccDEV for color profile handling (e.g., image processing pipelines, color management tools) are at risk of unexpected termination when processing untrusted profile files (GitHub Advisory).

A proof-of-concept crashing input (poc-crash-cf55e9ca4cd92b948da2034f7da3d4623168a514.txt) is publicly available in the GitHub issue tracker, generated via libFuzzer. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a user or application must open or process the malicious ICC profile file (GitHub Issue #322, GitHub Advisory).

1. Craft a malicious ICC profile: Create or obtain a malformed ICC color profile file that triggers the NULL pointer dereference in CIccProfile::CheckTagTypes(). The publicly available PoC input (poc-crash-cf55e9ca4cd92b948da2034f7da3d4623168a514.txt) from the GitHub issue can serve as a starting point.
2. Deliver the malicious file: Provide the crafted ICC profile to a target user or system that processes ICC profiles using the iccDEV library (e.g., via email attachment, file upload, or shared network resource).
3. Trigger processing: Induce the target application to open or validate the malicious ICC profile, causing CIccProfile::CheckTagTypes() to be called, which invokes CIccProfile::Validate() → LLVMFuzzerTestOneInput (or equivalent application entry point).
4. Achieve denial of service: The NULL pointer dereference at IccProfile.cpp:1978 causes a segmentation fault (SIGSEGV), crashing the application and resulting in a denial of service (GitHub Issue #322, GitHub Advisory).

• Logs: Application crash logs or core dumps referencing CIccProfile::CheckTagTypes() or CIccProfile::Validate() in the stack trace; MemorySanitizer or AddressSanitizer output indicating a NULL pointer dereference (READ at address 0x0) in IccProfile.cpp:1978.
• Process: Unexpected termination (SIGSEGV / DEADLYSIGNAL) of applications that process ICC color profiles using the iccDEV library.
• File System: Presence of unusual or malformed .icc or .icm profile files in directories processed by iccDEV-based applications, particularly files with minimal or malformed tag structures.

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix merged via pull request #325 on December 19, 2025. No configuration-based workarounds are available for prior versions. As an interim measure, restrict the processing of ICC color profiles from untrusted or external sources, and consider implementing file validation and sandboxing for color profile processing workflows until patching is complete (GitHub Advisory, GitHub PR #325).

The vulnerability was discovered and reported by security researcher xsscx using libFuzzer with MemorySanitizer, and the fix was contributed by ChrisCoxArt, a project contributor. The maintainer noted that libFuzzer identified several additional bugs in iccDEV beyond this CVE, including other NULL pointer dereferences, undefined behavior, and out-of-memory denial-of-service conditions, suggesting broader fuzzing-driven security improvements are underway for the project (GitHub PR #325, GitHub Issue #322).