Medium severity6.6NVD Advisory· Published Jan 6, 2026· Updated Jun 17, 2026

CVE-2026-21493

Description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3.1.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Color (software)/Iccdev
cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
Range: <2.3.1.2
International Color Consortium/iccDEVllm-fuzzy2 versions
<=2.3.1.1+ 1 more
- (no CPE)range: <=2.3.1.1
- (no CPE)range: < 2.3.1.2

Patches

Vulnerability mechanics

References

github.com/InternationalColorConsortium/iccDEV/commit/7ff76d1471077172f9659de8d9536443eac7c48fnvdPatch
github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-p85g-f9q7-jmjxnvdPatchVendor Advisory
github.com/InternationalColorConsortium/iccDEV/issues/358nvdExploitIssue TrackingVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.429
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000