{"id":"CVE-2026-21675","summary":"iccDEV has a Use After Free vulnerability in CIccCmm class via improper hint manager object deletion","details":"iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.","aliases":["GHSA-wcwx-794g-g78f"],"modified":"2026-08-12T15:31:35.141427Z","published":"2026-01-06T01:43:24.726Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20","CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21675.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21675.json"},{"type":"ADVISORY","url":"https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-wcwx-794g-g78f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21675"},{"type":"REPORT","url":"https://github.com/InternationalColorConsortium/iccDEV/issues/182"},{"type":"FIX","url":"https://github.com/InternationalColorConsortium/iccDEV/commit/510baf58fa48e00ebbb5dd577f0db4af8876bb31"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/internationalcolorconsortium/iccdev","events":[{"introduced":"0"},{"fixed":"e9b21d2294add231d3a21698e303ddb2e569dc00"},{"fixed":"510baf58fa48e00ebbb5dd577f0db4af8876bb31"}],"database_specific":{"cpe":"cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.3.1.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.3.1","v2.2.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21675.json","vanir_signatures_modified":"2026-08-12T15:31:35Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"196856997250058121030620842103230574045","length":12290},"id":"CVE-2026-21675-d0e89dac","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/510baf58fa48e00ebbb5dd577f0db4af8876bb31","target":{"file":"IccProfLib/IccCmm.cpp","function":"CIccXform::Create"}},{"deprecated":false,"digest":{"line_hashes":["108699563918436694241468625619571637807","20842210269984285652326971185766363648","123969087711108870787777803758917304357","51259986459931313284009389336596619394","5955491348816459485926004677540887918","107034619559705188665889722685251193703","333407744500621188779724191686819454300","133511231500723807972728796569916046802","116880170139408383988657542262389314069","224354745810475402183509891535160306960","327893095965369415110389905990804485280","15358529339439198534261289681765617267","199001130701242010575708497569996179188"],"threshold":0.9},"id":"CVE-2026-21675-e31b9455","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/510baf58fa48e00ebbb5dd577f0db4af8876bb31","target":{"file":"IccProfLib/IccCmm.cpp"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}