CVE-2026-21683: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21683 is a Type Confusion vulnerability in the iccDEV library, specifically within the icStatusCMM::CIccEvalCompare::EvaluateProfile() function in IccEval.cpp. It affects all iccDEV versions prior to 2.3.1.2 and was discovered by researcher xsscx, with the issue first reported on October 27, 2025, the fix merged on November 25, 2025, and the CVE published on January 7, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is a type confusion flaw (CWE-843) combined with improper input validation (CWE-20) in IccEval.cpp at line 139, where the code performs an unsafe downcast of a pointer to CIccTagLutAtoB when the underlying object is actually of type CIccTagMultiProcessElement. This invalid downcast triggers undefined behavior detected by UndefinedBehaviorSanitizer (UBSAN) as a runtime error. Additionally, a memory leak in CIccApplyXformMpe was identified alongside the type confusion. The vulnerability is triggered when a crafted ICC color profile (e.g., PCC/Lab_float-D50_2deg.icc or CMYK-3DLUTs2.icc) is processed by an application using the vulnerable library (GitHub Issue #183, GitHub PR #228).

Successful exploitation could result in complete system compromise, with high impact to confidentiality, integrity, and availability of the affected system. An attacker can craft a malicious ICC color profile that, when processed by an application using the vulnerable iccDEV library, triggers arbitrary code execution in the context of the processing application. User interaction is required — a user or automated pipeline must open or process the malicious profile — but no authentication or special privileges are needed from the attacker (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been published, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.055%, indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, GitHub Advisory).

1. Craft a malicious ICC profile: Create or modify an ICC color profile such that a tag expected to be of type CIccTagLutAtoB is instead a CIccTagMultiProcessElement object, exploiting the lack of type validation before the downcast in IccEval.cpp:139.
2. Deliver the profile: Distribute the malicious .icc file via email attachment, web download, or embedded in a document — any vector that causes the target user or application to process the file.
3. Trigger processing: Induce the victim to open the file with an application that uses the vulnerable iccDEV library (e.g., using tools like iccRoundTrip or any color-management-enabled application linked against iccDEV < 2.3.1.2).
4. Exploit type confusion: When icStatusCMM::CIccEvalCompare::EvaluateProfile() processes the profile, the invalid downcast executes with the wrong object type, causing undefined behavior that can be leveraged for arbitrary code execution or memory corruption.
5. Achieve objective: Depending on memory layout and platform, the attacker may achieve code execution, information disclosure, or application crash (GitHub Issue #183, GitHub PR #228).

• File System: Unexpected or externally sourced .icc color profile files in user download directories, temp folders, or application data paths; ICC profiles with unusual tag structures (e.g., CIccTagMultiProcessElement where CIccTagLutAtoB is expected).
• Logs: Application crash logs or core dumps referencing IccEval.cpp:139; UBSAN/ASAN runtime error messages such as runtime error: downcast of address ... which does not point to an object of type 'CIccTagLutAtoB'; LeakSanitizer reports involving CIccTagMultiProcessElement::GetNewApply().
• Process: Unexpected child processes or crashes spawned by color-management-enabled applications; abnormal termination of applications processing ICC profiles from untrusted sources.

The vendor has released iccDEV version 2.3.1.2, which contains the fix via Pull Request #228 (merging commits that add a type check before the downcast and fix the associated memory leak). All versions prior to 2.3.1.2 are vulnerable, and no workarounds are available. Organizations should upgrade to version 2.3.1.2 immediately, audit all systems and applications using the iccDEV library, and implement controls to restrict processing of ICC profiles from untrusted or external sources until patching is complete (GitHub Advisory, GitHub PR #228).

The vulnerability was noted in CISA's weekly vulnerability bulletin for the week of January 5, 2026, and covered by Red Packet Security's summary of that bulletin. Social media posts on Bluesky and Mastodon from security-focused accounts (e.g., TheHackerWire, cve.skyfleet.blue) flagged the CVE shortly after publication, though broader community discussion has been limited given the niche scope of the iccDEV library (CISA Bulletin, Red Packet Security).