CVE-2026-21685: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21685 is an undefined behavior vulnerability in the CIccTagLut16::Read() function of the iccDEV library, maintained by the International Color Consortium. It affects all iccDEV versions prior to 2.3.1.2 and was disclosed on January 7, 2026, with the underlying issue first reported on November 21, 2025. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is improper input validation (CWE-20) combined with reliance on undefined, unspecified, or implementation-defined behavior (CWE-758) in the CIccTagLut16::Read() function located in IccProfLib/IccTagLut.h. Specifically, the code at line 142 performs a reference binding to a null pointer of type icFloatNumber (alias for float), which is undefined behavior in C++. An attacker can trigger this by supplying a maliciously crafted ICC color profile file — for example, a variant of the Argyll null-byte-read profile — that causes the library to attempt reading curve data without first validating the count, leading to the null pointer dereference. The fix, introduced in PR #223, adds a count check before reading into curve data (GitHub Issue #213, GitHub PR #223).

Successful exploitation can cause application crashes (high availability impact) and limited data corruption (low integrity impact) in any software that uses the iccDEV library to process ICC color profiles. There is no confidentiality impact, as the vulnerability does not expose sensitive data. The attack vector is network-based but requires user interaction — a user must open or process a malicious ICC profile file — limiting the scope to the affected application rather than enabling direct lateral movement (GitHub Advisory).

A proof-of-concept demonstrating the undefined behavior is publicly available via GitHub Issue #213, using a crafted ICC profile file derived from a CVE-2023-46867 variant. As of the time of disclosure, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.055% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Issue #213, GitHub Advisory).

1. Obtain a malicious ICC profile: Acquire or craft a malformed ICC color profile that triggers the null pointer dereference in CIccTagLut16::Read(). A known working sample is the Argyll CVE-2023-46867 variant profile available at https://github.com/xsscx/Commodity-Injection-Signatures/raw/refs/heads/master/graphics/icc/Argyll_V302_null_byte_read-icmTable_setup_bwd-cve-2023-46867-variant-argyle-001.icc.
2. Deliver the profile to the target: Host the malicious .icc file on an attacker-controlled server or embed it in a document/web page, then socially engineer the target user into downloading and opening it with an application that uses the vulnerable iccDEV library.
3. Trigger processing: The target application invokes CIccTagLut16::Read() on the malformed profile. The function attempts to bind a reference to a null pointer at IccTagLut.h:142, triggering undefined behavior detected by UndefinedBehaviorSanitizer as runtime error: reference binding to null pointer of type 'icFloatNumber'.
4. Achieve denial of service or data corruption: The undefined behavior causes the application to crash or produce corrupted output, achieving the attacker's availability or integrity objective (GitHub Issue #213, GitHub PR #223).

• File System: Presence of unexpected or externally sourced .icc profile files in user download directories or temporary folders, particularly files with malformed tag structures (e.g., invalid AToB0Tag, BToA0Tag, AToB2Tag).
• Logs: Application logs showing runtime error: reference binding to null pointer of type 'icFloatNumber' or UndefinedBehaviorSanitizer (UBSan) output from iccDEV-linked tools; log entries indicating Unable to parse '*.icc' as ICC profile! with Critical Error(s) and NonCompliant validation results.
• Process: Unexpected crashes or abnormal termination of applications that process ICC color profiles (e.g., iccDumpProfile), particularly when processing externally supplied profile files (GitHub Issue #213).

The only available remediation is upgrading iccDEV to version 2.3.1.2 or later, which includes the fix from PR #223 that adds a count validation check before reading curve data in CIccTagLut16::Read(). No configuration-based workarounds are available. As an interim measure, organizations should implement controls to validate and restrict ICC color profiles from untrusted sources, and educate users to avoid opening ICC profile files from unknown origins (GitHub Advisory, GitHub PR #223).

The vulnerability was reported by researcher xsscx and remediated by contributor ChrisCoxArt, with the fix merged on November 24, 2025, and the formal advisory published on January 3, 2026. The CISA vulnerability bulletin for the week of January 5, 2026 included a reference to this CVE. Community discussion has been limited, with mentions on Bluesky and vulnerability tracking platforms, reflecting the relatively narrow impact scope of the library (GitHub Advisory).