CVE-2026-21485: iccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag()
Published Jan 6, 2026
·Updated
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (UB) and Out of Memory errors. This issue is fixed in version 2.3.1.2.
Affected Software
2 affected components
iccDEV iccDEV<2.3.1.2
Color iccDEV<2.3.1.2
Remediation
Event History
Jan 6, 2026
CVE Published
via MITRE·03:17 AM
Data Sourced
via MITRE·03:17 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Aug 29, 58046
Event
via FIRST·06:57 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-21485?
CVE-2026-21485 has been classified as having a high severity due to potential Undefined Behavior and Out of Memory errors.
2
How do I fix CVE-2026-21485?
To fix CVE-2026-21485, upgrade to version 2.3.1.2 or later of the iccDEV library.
3
What versions of iccDEV are affected by CVE-2026-21485?
Versions 2.3.1.1 and below of iccDEV are affected by CVE-2026-21485.
4
What types of errors are associated with CVE-2026-21485?
CVE-2026-21485 is associated with Undefined Behavior and Out of Memory errors.
5
Who is the vendor responsible for the CVE-2026-21485 vulnerability?
The vendor responsible for CVE-2026-21485 is iccDEV.