{"id":"CVE-2026-21493","summary":"iccDEV has Type Confusion during XML Curve Serialization","details":"iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3.1.2.","aliases":["GHSA-p85g-f9q7-jmjx"],"modified":"2026-08-12T16:24:49.207748Z","published":"2026-01-06T14:11:27.054Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-188","CWE-703","CWE-843"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21493.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21493.json"},{"type":"ADVISORY","url":"https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-p85g-f9q7-jmjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21493"},{"type":"REPORT","url":"https://github.com/InternationalColorConsortium/iccDEV/issues/358"},{"type":"FIX","url":"https://github.com/InternationalColorConsortium/iccDEV/commit/7ff76d1471077172f9659de8d9536443eac7c48f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/internationalcolorconsortium/iccdev","events":[{"introduced":"0"},{"fixed":"ad159eb00bf46fa17496a0f8c4cb49de8918062c"},{"fixed":"7ff76d1471077172f9659de8d9536443eac7c48f"}],"database_specific":{"cpe":"cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.3.1.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.3.1.1","v2.3.1","v2.2.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21493.json","vanir_signatures_modified":"2026-08-12T16:24:49Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"110064241831361690890189230178413542315","length":6046},"id":"CVE-2026-21493-0311b202","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/7ff76d1471077172f9659de8d9536443eac7c48f","target":{"file":"IccXML/IccLibXML/IccMpeXml.cpp","function":"CIccSinglSampledeCurveXml::ParseXml"}},{"signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/7ff76d1471077172f9659de8d9536443eac7c48f","target":{"file":"IccXML/IccLibXML/IccMpeXml.cpp","function":"CIccSinglSampledeCurveXml::ToXml"},"deprecated":false,"digest":{"function_hash":"75196645155416941916180165694899830133","length":666},"id":"CVE-2026-21493-72c88922","signature_type":"Function"},{"digest":{"line_hashes":["117387768347248335351679023783324180201","101235199530325061532122041777497005015","133047812634706947160391365419832712035","279688390852860227061166491579034851256","243176632768332646538448427707117937441","159771193107068519326699228888587883271","10245686424298152902186949261481776486","19884503862379189551476209997756997722","1732542165705482718644944598665215292","97716221957976714252615173068588649262","192527278776828826617242411944240902456","74105399470933437169978674946638180057","276576452292086885466835079723937641572","80555781190849383398109946166279084060","73429243712506389744729256379572002800","1294161251015939865364148892417939954","145496289188417304351780424907636825358","304131625164798304062574137827812546387","10975978038175301890225737603855797205","15372233290228749577050480921973635008","193067485275965482553645412431390125616","330713414980470924268971363333560834723","84850587691177660425778792193819822368"],"threshold":0.9},"id":"CVE-2026-21493-85b0846d","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/7ff76d1471077172f9659de8d9536443eac7c48f","target":{"file":"IccXML/IccLibXML/IccMpeXml.cpp"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H"}]}