CVE-2026-21675

iccDEV has a Use After Free vulnerability in CIccCmm class via improper hint manager object deletion

Published Jan 6, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.

Analysis

Technical impact

A memory corruption flaw exists in the ICC development libraries where a hint manager object is deleted prematurely during the creation of a transform. This Use After Free condition can lead to crashes and, if an attacker can control the deleted memory’s reuse, can be leveraged for arbitrary code execution. The weakness is categorized as a Use After Free and also indicates improper use of input data during memory management.

Affected Systems

The vulnerability affects the International Color Consortium’s iccDEV libraries version 2.3.1 and earlier. The issue is resolved in version 2.3.1.1 and later releases. No other vendors or product lines are mentioned as impacted.

Risk and Exploitability

The flaw carries a high CVSS score of 9.8, indicating a severe risk, but its EPSS score is less than 1%, suggesting that exploitation is currently rare. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Likely exploitation would require execution of code that loads the affected library, such as through a local application or a specially crafted ICC profile that triggers the vulnerable function.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

InternationalColorConsortium

iccDEV

affected

Version	Status	Constraints
`< 2.3.1.1`	affected	—

Configuration 1 [-]

cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Versions
Internationalcolorconsortium	Iccdev	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the iccDEV libraries to version 2.3.1.1 or later to eliminate the Use After Free bug
If an upgrade is not immediately possible, isolate or remove any software that loads the vulnerable library versions from network exposure, reducing the attack surface
After applying the patch, restart all services and applications that use the library to ensure the vulnerable memory is cleared from use
Continuously monitor crash reports and logs for evidence of memory corruption that may signal other related issues

Generated by OpenCVE AI on April 18, 2026 at 08:16 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.450% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/InternationalColorConsortium/iccDEV/commit/510baf58fa48e00ebbb5dd577f0db4af8876bb31
https://github.com/InternationalColorConsortium/iccDEV/issues/182
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-wcwx-794g-g78f

History

Jan 12, 2026 9:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Color Color iccdev
CPEs		cpe:2.3:a:color:iccdev::::::::
Vendors & Products		Color Color iccdev

Jan 6, 2026 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jan 6, 2026 2:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Internationalcolorconsortium Internationalcolorconsortium iccdev
Vendors & Products		Internationalcolorconsortium Internationalcolorconsortium iccdev

Jan 6, 2026 2:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.
Title		iccDEV has a Use After Free vulnerability in CIccCmm class via improper hint manager object deletion
Weaknesses		CWE-20 CWE-416
References		https://github.com/InternationalColorConsortium/iccDEV/commit/510baf58fa48e00ebbb5dd577f0db4af8876bb31 https://github.com/InternationalColorConsortium/iccDEV/issues/182 https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-wcwx-794g-g78f
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`