CVE-2026-21487 iccDEV has Out-of-bounds Read, Use of Out-of-range Pointer Offset and Improper Input Validation

Medium 6.1 Published 6 Jan 2026 Updated 6 Jan 2026

Attackers can trigger out-of-bounds reads and pointer errors in iccDEV libraries via malicious ICC profiles, potentially causing crashes or code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-21487?

CVE-2026-21487 is a medium-severity memory corruption vulnerability in Color Iccdev, published on 6 Jan 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have an Out-of-bounds Read, Use of Out-of-range Pointer Offset and have Improper Input Validation in its CIccProfile::LoadTag function. This issue is fixed in version 2.3.1.2.

Weakness: CWE-823, CWE-20, CWE-125

Which versions are affected by CVE-2026-21487?

It affects 1 product.

Products include Color Iccdev.

How do I fix CVE-2026-21487?

No fix has been published for CVE-2026-21487 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-21487 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-21487 exists.

All Color Iccdev vulnerabilities

Sources

Also known as GHSA-xq7x-9524-f7cp.