Description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `icStatusCMM::CIccEvalCompare::EvaluateProfile()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Published: 2026-01-07
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Type confusion in icStatusCMM::CIccEvalCompare::EvaluateProfile
Action: Apply Patch
AI Analysis

Impact

A flaw in the EvaluateProfile method of icStatusCMM::CIccEvalCompare allows a mismatch between expected and actual object types when processing a crafted ICC profile. This type confusion may cause unexpected behavior during profile evaluation. The vulnerability is identified as a classic type confusion and is categorized under CWE-20 and CWE-843.

Affected Systems

International Color Consortium's iccDEV library, any version earlier than 2.3.1.2, is impacted. The issue arises when the library parses ICC color profiles, meaning applications that embed iccDEV to load or manipulate such profiles are susceptible. The affected versions are all releases before the patch included in 2.3.1.2.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. This vulnerability is not listed in CISA's KEV catalog. The description does not specify the attack vector, but it suggests that an attacker could supply a crafted ICC file to trigger the type confusion. Whether the attack is local or remote is not detailed in the CVE entry.

Generated by OpenCVE AI on April 18, 2026 at 20:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the iccDEV library to version 2.3.1.2 or newer, which includes the type confusion fix.
  • Immediately review any components that load ICC profiles from untrusted sources; consider disabling profile loading or placing these applications in a sandbox to limit the impact while awaiting an update.
  • Keep the system patched by monitoring installer or vendor advisories and applying subsequent patches to continue protecting against newly discovered issues.

Generated by OpenCVE AI on April 18, 2026 at 20:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Color
Color iccdev
Weaknesses CWE-843
CPEs cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
Vendors & Products Color
Color iccdev

Thu, 08 Jan 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Internationalcolorconsortium
Internationalcolorconsortium iccdev
Vendors & Products Internationalcolorconsortium
Internationalcolorconsortium iccdev

Wed, 07 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Jan 2026 21:30:00 +0000

Type Values Removed Values Added
Description iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `icStatusCMM::CIccEvalCompare::EvaluateProfile()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Title iccDEV has Type Confusion in icStatusCMM::CIccEvalCompare::EvaluateProfile()
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Color Iccdev
Internationalcolorconsortium Iccdev
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-01-07T21:31:28.409Z

Reserved: 2026-01-02T18:45:27.396Z

Link: CVE-2026-21683

cve-icon Vulnrichment

Updated: 2026-01-07T21:31:24.907Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-07T22:15:44.327

Modified: 2026-01-12T18:02:27.377

Link: CVE-2026-21683

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T20:15:09Z

Weaknesses