Medium severity5.5NVD Advisory· Published Jan 7, 2026· Updated Jun 17, 2026

CVE-2026-21498

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the XML calculator parser. This issue has been patched in version 2.3.1.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Color (software)/Iccdev
cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
Range: <2.3.1.2
International Color Consortium/iccDEVllm-fuzzy2 versions
<2.3.1.2+ 1 more
- (no CPE)range: <2.3.1.2
- (no CPE)range: < 2.3.1.2

Patches

Vulnerability mechanics

References

github.com/InternationalColorConsortium/iccDEV/commit/75f124f40ba45491211cb4b67f0e05b7c7d59553nvdPatch
github.com/InternationalColorConsortium/iccDEV/commit/bdfa31940726aaabb0a6f19194d9062ba0598959nvdPatch
github.com/InternationalColorConsortium/iccDEV/issues/375nvdExploitIssue Tracking
github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-6822-qvxq-m736nvdThird Party Advisory
github.com/InternationalColorConsortium/iccDEV/pull/404nvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000