CVE-2026-21497

Katalog CVE

CVSS 5.5 · Medium EPSS 0,19%

Kerentanan Improper Input Validation pada color iccdev. Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via an unknown tag parser. This issue has been patched in version 2.3.1.2.

Rincian

Terbit di NVD

7 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-252: Unchecked Return Value
CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/commit/9419cac7f084197941994b8b9d17def204008385 patch
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-7gv7-cmrv-4j85 advisory pihak ketiga
• https://github.com/InternationalColorConsortium/iccDEV/issues/374 exploit · issue tracking
• https://github.com/InternationalColorConsortium/iccDEV/pull/403 issue tracking