CVE-2026-21495

Division by Zero in iccDEV TIFF Image Reader

Published Jan 7, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to division by zero in the TIFF Image Reader. This issue has been patched in version 2.3.1.2.

Analysis

Technical impact

A flaw in iccDEV’s TIFF image reader causes a division by zero when parsing certain TIFF files, which can crash the host process. The crash results in a denial of service for any application that relies on the library. The vulnerability falls under CWE-20 (Improper Input Validation) and CWE-369 (Divide by Zero).

Affected Systems

International Color Consortium’s iccDEV library, versions prior to 2.3.1.2, is affected. Any system that uses a vulnerable iteration of iccDEV and processes TIFF images is at risk.

Risk and Exploitability

The CVSS score of 5.5 indicates medium severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: a malicious TIFF file can be supplied by any user or application that loads the library, triggering a crash without requiring network access or special privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

InternationalColorConsortium

iccDEV

affected

Version	Status	Constraints
`< 2.3.1.2`	affected	—

Configuration 1 [-]

cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Versions
Internationalcolorconsortium	Iccdev	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade iccDEV to version 2.3.1.2 or later, which contains the patch for the division by zero issue.
Audit all deployments to ensure that no older iccDEV versions are present, particularly on services that handle user‑supplied image data.
Where upgrading is not immediately possible, restrict the processing of TIFF files in critical applications or isolate the vulnerable library in a sandboxed environment to contain potential crashes.

Generated by OpenCVE AI on April 18, 2026 at 16:53 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.128% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/InternationalColorConsortium/iccDEV/commit/10c34179a0332a869c2b46e305a9cd23a6311dfe
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-xhrm-79rg-5784

History

Jan 9, 2026 10:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Color Color iccdev
CPEs		cpe:2.3:a:color:iccdev::::::::
Vendors & Products		Color Color iccdev

Jan 8, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Internationalcolorconsortium Internationalcolorconsortium iccdev
Vendors & Products		Internationalcolorconsortium Internationalcolorconsortium iccdev

Jan 7, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 7, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to division by zero in the TIFF Image Reader. This issue has been patched in version 2.3.1.2.
Title		Division by Zero in iccDEV TIFF Image Reader
Weaknesses		CWE-20 CWE-369
References		https://github.com/InternationalColorConsortium/iccDEV/commit/10c34179a0332a869c2b46e305a9cd23a6311dfe https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-xhrm-79rg-5784
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}`