CVE-2026-21499

Katalog CVE

CVSS 5.5 · Medium EPSS 0,19%

Kerentanan Improper Input Validation pada color iccdev. Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the XML parser. This issue has been patched in version 2.3.1.2.

Rincian

Terbit di NVD

7 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-476: NULL Pointer Dereference
CWE-690: Unchecked Return Value to NULL Pointer Dereference

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternationalColorConsortium/iccDEV/commit/00c03013e11b35ddbd7caae4368d1add185849d9 patch
• https://github.com/InternationalColorConsortium/iccDEV/commit/af299895bbcbecca6f67d6dc3d8e1dc92f1fc3fa patch
• https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-c3pv-2cpf-7v2p advisory pihak ketiga
• https://github.com/InternationalColorConsortium/iccDEV/issues/372 exploit · issue tracking
• https://github.com/InternationalColorConsortium/iccDEV/blob/8e71f0a701abcbd554725ba7b70258203e682a61/IccXML/Ic... product
• https://github.com/InternationalColorConsortium/iccDEV/pull/412 issue tracking