{"id":"CVE-2026-21677","summary":"iccDEV has Undefined Behavior in CIccCLUT::Init()","details":"iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have Undefined Behavior in its CIccCLUT::Init function which initializes and sets the size of a CLUT. This issue is fixed in version 2.3.1.1.","aliases":["GHSA-95w5-jvqf-3994"],"modified":"2026-08-12T15:31:34.391906Z","published":"2026-01-06T03:11:30.537Z","database_specific":{"cwe_ids":["CWE-20","CWE-758"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21677.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21677.json"},{"type":"ADVISORY","url":"https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-95w5-jvqf-3994"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21677"},{"type":"REPORT","url":"https://github.com/InternationalColorConsortium/iccDEV/issues/181"},{"type":"FIX","url":"https://github.com/InternationalColorConsortium/iccDEV/commit/201125fbda22c8e4ea95800a6b427093fa4b8a22"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/internationalcolorconsortium/iccdev","events":[{"introduced":"0"},{"fixed":"e9b21d2294add231d3a21698e303ddb2e569dc00"},{"fixed":"201125fbda22c8e4ea95800a6b427093fa4b8a22"}],"database_specific":{"cpe":"cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.3.1.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.3.1","v2.2.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21677.json","vanir_signatures_modified":"2026-08-12T15:31:34Z","vanir_signatures":[{"digest":{"function_hash":"227823673230089686583901690369369785497","length":1598},"id":"CVE-2026-21677-22449e38","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/201125fbda22c8e4ea95800a6b427093fa4b8a22","target":{"file":"IccProfLib/IccTagLut.cpp","function":"CIccTagLut16::Read"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"37742725407981482292833431319569651875","length":2983},"id":"CVE-2026-21677-92f6a96f","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/201125fbda22c8e4ea95800a6b427093fa4b8a22","target":{"file":"IccProfLib/IccTagLut.cpp","function":"CIccTagLutAtoB::Read"}},{"target":{"file":"IccProfLib/IccTagLut.cpp"},"deprecated":false,"digest":{"line_hashes":["247746992190782528443917574993732645355","244687519752999072135853869424983412130","321959825203956562735108588211645928023","298964908695673890672950036474457781231","210078484563400017643183021655945112774","65632973338351993102087360350825118402","193392673263979440393526601341743303502","246803641952072560880370075464142768841","144847476285813411852433624211318456677","150378545483853071393310011252166591988","61585765364201992563937995400240264071","321128552509474935344103952746714037606","227979766744028962923669501457237095813","260145120059704398075758220821180702276","321128552509474935344103952746714037606","227979766744028962923669501457237095813","301173243984739557066419498996407234575"],"threshold":0.9},"id":"CVE-2026-21677-c207b3bb","signature_type":"Line","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/201125fbda22c8e4ea95800a6b427093fa4b8a22"},{"source":"https://github.com/internationalcolorconsortium/iccdev/commit/201125fbda22c8e4ea95800a6b427093fa4b8a22","target":{"file":"IccProfLib/IccTagLut.cpp","function":"CIccCLUT::Init"},"deprecated":false,"digest":{"function_hash":"86453871066112910183814057271044516794","length":1020},"id":"CVE-2026-21677-da02138a","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-21677-ef7bb07b","signature_type":"Function","signature_version":"v1","source":"https://github.com/internationalcolorconsortium/iccdev/commit/201125fbda22c8e4ea95800a6b427093fa4b8a22","target":{"file":"IccProfLib/IccTagLut.cpp","function":"CIccTagLut8::Read"},"deprecated":false,"digest":{"function_hash":"208884732708469336603410941307258761163","length":1518}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}