CVE-2026-21688: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21688 is a Type Confusion vulnerability in the iccDEV library's SIccCalcOp::ArgsPushed() function located at IccProfLib/IccMpeCalc.cpp. It affects all iccDEV versions prior to 2.3.1.2 and was reported on December 29, 2025, with a patch merged on January 3, 2026, and the CVE published on January 7, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is a combination of improper input validation (CWE-20), integer overflow/wraparound (CWE-190), NULL pointer dereference (CWE-476), and incorrect conversion between numeric types (CWE-681) in the SIccCalcOp::ArgsPushed() function. Specifically, at line 2426 of IccMpeCalc.cpp, a signed integer overflow occurs when computing 65536 * 65537, which cannot be represented in type int, and a separate NULL pointer dereference occurs in IccXML/IccLibXML/IccMpeXml.cpp:3123. The fix clips MPE/calc argument counts against the maximum stack size and promotes values to larger integer types to prevent overflow, with a static assert ensuring the max stack size fits in the function result type (GitHub Issue, GitHub PR).

Successful exploitation allows an attacker to achieve arbitrary code execution on systems running vulnerable iccDEV versions by supplying a crafted malicious ICC color profile. The vulnerability has high impact across all three security dimensions: confidentiality (unauthorized data access), integrity (data modification), and availability (service disruption or crash). Any application that uses the iccDEV library to process ICC profiles — including image editors, color management tools, and document processors — is potentially affected (GitHub Advisory, Feedly).

A proof-of-concept exploit (a crafted signed-integer-overflow.xml file convertible to a malicious ICC profile) is publicly available in the GitHub issue tracker (GitHub Issue). Exploitation requires user interaction — a user must open or process the malicious ICC profile — but no authentication or special privileges are required. The EPSS score is approximately 0.057%, and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time (Feedly).

1. Craft malicious ICC profile: Create a specially crafted XML file (e.g., signed-integer-overflow.xml) containing a multiProcessElementType tag with a CalculatorElement that triggers the integer overflow condition (e.g., values that cause 65536 * 65537 to be computed as a signed int).
2. Convert to ICC format: Use the iccFromXml tool to convert the malicious XML to an ICC profile file (e.g., iccFromXml signed-integer-overflow.xml malicious.icc).
3. Deliver to target: Distribute the malicious .icc file to a target user via email attachment, web download, or embedding in a document — any vector that causes the file to be processed by an application using the vulnerable iccDEV library.
4. Trigger processing: Induce the target user to open or process the malicious ICC profile with a vulnerable application, causing SIccCalcOp::ArgsPushed() to execute with the crafted input.
5. Achieve code execution: The signed integer overflow or NULL pointer dereference condition is triggered, potentially leading to memory corruption and arbitrary code execution in the context of the application processing the profile (GitHub Issue, GitHub Advisory).

• File System: Presence of unexpected .icc or .xml files with unusually large or malformed CalculatorElement values in multiProcessElementType tags; files named signed-integer-overflow.icc or similar.
• Logs: Application crash logs or UndefinedBehaviorSanitizer (UBSan) output referencing IccProfLib/IccMpeCalc.cpp:2426 with messages such as signed integer overflow: 65536 * 65537 cannot be represented in type 'int'; errors referencing IccXML/IccLibXML/IccMpeXml.cpp:3123 with member access within null pointer.
• Process: Unexpected crashes or abnormal termination of applications that process ICC color profiles; processes spawning unexpected child processes after opening an ICC file (GitHub Issue).

The only available remediation is upgrading iccDEV to version 2.3.1.2 or later, which clips MPE/calc argument counts against the maximum stack size and uses larger integer types to prevent overflow. No configuration-based workarounds are available. As an interim measure, organizations should restrict processing of ICC profiles from untrusted sources and inventory all applications depending on iccDEV versions prior to 2.3.1.2 (GitHub Advisory, GitHub PR).

The vulnerability was reported by security researcher xsscx on December 29, 2025, and remediated by ChrisCoxArt (a contributor) with a patch merged on January 3, 2026. The CISA vulnerability bulletin for the week of January 5, 2026 included this CVE, indicating it received attention from U.S. government cybersecurity authorities (CISA Bulletin). Coverage also appeared on The Hacker Wire and security aggregators shortly after disclosure (The Hacker Wire).