CVE-2026-21493

Katalog CVE

CVSS 6.6 · Medium EPSS 0,19%

Kerentanan Reliance on Data/Memory Layout pada color iccdev. Skor CVSS 3.1 6.6 (Medium) menurut github.com.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3.1.2.

Rincian

Terbit di NVD

6 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.6 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-188: Reliance on Data/Memory Layout
CWE-703: Improper Check or Handling of Exceptional Conditions
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/issues/358 exploit · issue tracking · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-p85g-f9q7-jmjx patch · advisory vendor
• https://github.com/InternationalColorConsortium/iccDEV/commit/7ff76d1471077172f9659de8d9536443eac7c48f patch