CVE-2026-21485

Katalog CVE

CVSS 8.8 · High EPSS 0,37%

Kerentanan Improper Input Validation pada color iccdev. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (UB) and Out of Memory errors. This issue is fixed in version 2.3.1.2.

Rincian

Terbit di NVD

6 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-125: Out-of-bounds Read
CWE-190: Integer Overflow or Wraparound
CWE-400: Uncontrolled Resource Consumption
CWE-476: NULL Pointer Dereference
CWE-787: Out-of-bounds Write
CWE-1284: Improper Validation of Specified Quantity in Input

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/issues/340 exploit · issue tracking · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-chp2-4gv5-2432 advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/commit/c136aac51d25cbb4d9db63f071edad4f088843df patch