Description
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTag:IsTypeCompressed()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Published: 2026-01-07
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory corruption
Action: Patch
AI Analysis

Impact

The vulnerability is a type confusion flaw in the CIccTag:IsTypeCompressed() function of the iccDEV library. It can result in memory corruption or improper handling of ICC color profiles, potentially leading to application crashes or unspecified behavior. The weakness is categorized as type confusion and related to invalid type checks.

Affected Systems

The affected vendor is International Color Consortium, software product iccDEV. All releases before version 2.3.1.2 are vulnerable. No other vendors or product families are listed.

Risk and Exploitability

The CVSS score is 5.4, indicating moderate severity, while the EPSS score is less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog, and no workarounds are available. Attackers could potentially exploit the flaw by providing a crafted ICC profile to a system that consumes the vulnerable library, which could trigger type confusion and possibly lead to memory corruption.

Generated by OpenCVE AI on April 18, 2026 at 07:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update iccDEV to version 2.3.1.2 or later.
  • Ensure the application restricts loading of ICC profiles from trusted sources.
  • Monitor the application for crashes or abnormal behavior after an update.

Generated by OpenCVE AI on April 18, 2026 at 07:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Jan 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Color
Color iccdev
Weaknesses CWE-843
CPEs cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
Vendors & Products Color
Color iccdev

Thu, 08 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Jan 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Internationalcolorconsortium
Internationalcolorconsortium iccdev
Vendors & Products Internationalcolorconsortium
Internationalcolorconsortium iccdev

Wed, 07 Jan 2026 22:00:00 +0000

Type Values Removed Values Added
Description iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTag:IsTypeCompressed()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Title iccDEV has Type Confusion in CIccTag:IsTypeCompressed()
Weaknesses CWE-1025
CWE-140
CWE-20
CWE-476
CWE-697
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'}

Subscriptions

Color Iccdev
Internationalcolorconsortium Iccdev
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-01-08T14:40:49.437Z

Reserved: 2026-01-02T18:45:27.397Z

Link: CVE-2026-21691

cve-icon Vulnrichment

Updated: 2026-01-08T14:40:44.094Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-07T22:15:45.527

Modified: 2026-01-12T18:26:52.107

Link: CVE-2026-21691

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T08:00:05Z

Weaknesses