CVE‑2026‑21684 describes undefined behavior in the function CIccTagSpectralViewingConditions() within the iccDEV library. Undefined behavior can result in unpredictable memory handling, potentially allowing an attacker to corrupt data structures, crash the application, or execute arbitrary code if the library is used to process malicious input.

The affected product is InternationalColorConsortium iccDEV. All versions prior to 2.3.1.2 are vulnerable. Users who process ICC color profiles through this library are at risk.

The CVSS score of 7.1 indicates moderate to high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is the processing of untrusted ICC profiles, such as those received from external stakeholders or embedded in client files. Exploitation requires the attacker to supply a specifically crafted ICC profile that triggers the undefined behavior, which may lead to memory corruption or code execution if the application is not secured.