{"id":"CVE-2026-21488","summary":"iccDEV has Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination","details":"iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination through its CIccTagText::Read function. This issue is fixed in version 2.3.1.2.","aliases":["GHSA-4j2g-rvv4-86vg"],"modified":"2026-08-12T15:31:35.888330Z","published":"2026-01-06T13:52:21.380Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-122","CWE-125","CWE-170"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21488.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21488.json"},{"type":"ADVISORY","url":"https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-4j2g-rvv4-86vg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21488"},{"type":"FIX","url":"https://github.com/InternationalColorConsortium/iccDEV/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/internationalcolorconsortium/iccdev","events":[{"introduced":"0"},{"fixed":"ad159eb00bf46fa17496a0f8c4cb49de8918062c"},{"fixed":"9daaccceb231c43db8cab312ee5bbe9d2aa6b153"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.3.1.2"}]}}],"versions":["v2.3.1.1","v2.3.1","v2.2.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21488.json","vanir_signatures_modified":"2026-08-12T15:31:35Z","vanir_signatures":[{"digest":{"line_hashes":["112053873367473987317481232328804214564","183639400736786594935674290888231917450","183696748620832168832735563258355408551","109935662559947153377607870689957425474","289216721379526908910931081133457945981","274291726934222466697134320004752117621","233680629251865353524537826745186845582","305728945917711294397778407256411803293","7148863491717630411893299272751297829","99062364338985417093057235843837789419","335487090220098331220909252406236204370","206759090495761770040848832225516132940","41199927284814296931918923707550240255","289216721379526908910931081133457945981","274291726934222466697134320004752117621","233680629251865353524537826745186845582","305728945917711294397778407256411803293","7148863491717630411893299272751297829","79664735675035722314869020844697711172","165097030602894090159572605601849606733","255124914137808461858265738369444482933","213809964100037604110740721436640559166","77936397294284966625671803786699051515","253930792495905454549173052832020495311","233680629251865353524537826745186845582","305728945917711294397778407256411803293","7148863491717630411893299272751297829","63917277668774302532200798008025484490","267265029416216576855195865617714669205","92540802182261855024743436187735511568","258465017208017860053114594907712828833","289216721379526908910931081133457945981","274291726934222466697134320004752117621","70688350822016584305501734175344091000","143236905889349786205766767374481805474","315739280192301642559226903520043456266","415828319674057432309085997386097568","225200976897218192904848474858908558415","9746067055305428949155105575803507686","182343106838710419286230546836165458927","335371570645204178055694625245782178837","290954544343627734993472348966212321420","185933559475239644283805490749835021499","28894496636036124006770797837264257044","71997541720239693069689759012473954408","280983634641631564853356649922976333996","338826249837255901440910815909394179385","111642647446744223210769518755922625147","152780728962503810666130044593350419771","48683739176627715671032203818854430344","204124109822707829234757470425360989234","288368012872390508492762511155406954785","6937770810566862567808716940819948328","324971070512734625473950134568598264040"],"threshold":0.9},"id":"CVE-2026-21488-1f4a4150","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153","target":{"file":"IccProfLib/IccTagBasic.cpp"},"deprecated":false},{"digest":{"function_hash":"95646718285613999726618489367179703200","length":503},"id":"CVE-2026-21488-3c350ba6","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153","target":{"file":"IccProfLib/IccTagBasic.cpp","function":"CIccTagUtf16Text::Read"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"204593248860531807481187117630830471532","length":1278},"id":"CVE-2026-21488-46728f1c","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153","target":{"file":"IccProfLib/IccTagBasic.cpp","function":"CIccTagNamedColor2::Read"}},{"signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153","target":{"file":"IccProfLib/IccTagBasic.cpp","function":"CIccTagXYZ::Read"},"deprecated":false,"digest":{"function_hash":"288364720733211411783794038718742831935","length":559},"id":"CVE-2026-21488-7892aa48","signature_type":"Function"},{"target":{"file":"IccProfLib/IccTagBasic.cpp","function":"CIccTagUtf8Text::Read"},"deprecated":false,"digest":{"function_hash":"298863653837398030649055255731647903773","length":544},"id":"CVE-2026-21488-8a702c10","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153"},{"target":{"file":"IccProfLib/IccTagBasic.cpp","function":"CIccTagText::Read"},"deprecated":false,"digest":{"length":493,"function_hash":"49019780230613242290726993178351824631"},"id":"CVE-2026-21488-b46f6b24","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153"},{"deprecated":false,"digest":{"function_hash":"9457177022459509661072428238677682791","length":1017},"id":"CVE-2026-21488-de575375","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153","target":{"file":"IccProfLib/IccTagBasic.cpp","function":"CIccTagNamedColor2::SetSize"}},{"id":"CVE-2026-21488-f6d3415f","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153","target":{"file":"IccProfLib/IccTagBasic.cpp","function":"CIccTagTextDescription::Read"},"deprecated":false,"digest":{"length":1374,"function_hash":"249756312980100634008691181854251493409"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"}]}