CVE-2026-21683

iccDEV has Type Confusion in icStatusCMM::CIccEvalCompare::EvaluateProfile()

Published Jan 7, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `icStatusCMM::CIccEvalCompare::EvaluateProfile()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

Analysis

Technical impact

A flaw in the EvaluateProfile method of icStatusCMM::CIccEvalCompare allows a mismatch between expected and actual object types when processing a crafted ICC profile. This type confusion may cause unexpected behavior during profile evaluation. The vulnerability is identified as a classic type confusion and is categorized under CWE-20 and CWE-843.

Affected Systems

International Color Consortium's iccDEV library, any version earlier than 2.3.1.2, is impacted. The issue arises when the library parses ICC color profiles, meaning applications that embed iccDEV to load or manipulate such profiles are susceptible. The affected versions are all releases before the patch included in 2.3.1.2.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. This vulnerability is not listed in CISA's KEV catalog. The description does not specify the attack vector, but it suggests that an attacker could supply a crafted ICC file to trigger the type confusion. Whether the attack is local or remote is not detailed in the CVE entry.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

InternationalColorConsortium

iccDEV

affected

Version	Status	Constraints
`< 2.3.1.2`	affected	—

Configuration 1 [-]

cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Versions
Internationalcolorconsortium	Iccdev	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the iccDEV library to version 2.3.1.2 or newer, which includes the type confusion fix.
Immediately review any components that load ICC profiles from untrusted sources; consider disabling profile loading or placing these applications in a sandbox to limit the impact while awaiting an update.
Keep the system patched by monitoring installer or vendor advisories and applying subsequent patches to continue protecting against newly discovered issues.

Generated by OpenCVE AI on April 18, 2026 at 20:11 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.318% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/InternationalColorConsortium/iccDEV/issues/183
https://github.com/InternationalColorConsortium/iccDEV/pull/228
https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-f2wp-j3fr-938w

History

Jan 12, 2026 6:15 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Color Color iccdev
Weaknesses		CWE-843
CPEs		cpe:2.3:a:color:iccdev::::::::
Vendors & Products		Color Color iccdev

Jan 8, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Internationalcolorconsortium Internationalcolorconsortium iccdev
Vendors & Products		Internationalcolorconsortium Internationalcolorconsortium iccdev

Jan 7, 2026 10:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jan 7, 2026 9:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `icStatusCMM::CIccEvalCompare::EvaluateProfile()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Title		iccDEV has Type Confusion in icStatusCMM::CIccEvalCompare::EvaluateProfile()
Weaknesses		CWE-20
References		https://github.com/InternationalColorConsortium/iccDEV/issues/183 https://github.com/InternationalColorConsortium/iccDEV/pull/228 https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-f2wp-j3fr-938w
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`