Unrated severityNVD Advisory· Published Jan 7, 2026· Updated Jan 7, 2026

NULL Pointer Dereference in iccDEV XML Calculator Parser

CVE-2026-21498

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the XML calculator parser. This issue has been patched in version 2.3.1.2.

Affected products

iccDEV/iccDEVllm-fuzzy
Range: <2.3.1.2
InternationalColorConsortium/iccDEVv5
Range: < 2.3.1.2

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/InternationalColorConsortium/iccDEV/commit/75f124f40ba45491211cb4b67f0e05b7c7d59553mitrex_refsource_MISC
github.com/InternationalColorConsortium/iccDEV/commit/bdfa31940726aaabb0a6f19194d9062ba0598959mitrex_refsource_MISC
github.com/InternationalColorConsortium/iccDEV/issues/375mitrex_refsource_MISC
github.com/InternationalColorConsortium/iccDEV/pull/404mitrex_refsource_MISC
github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-6822-qvxq-m736mitrex_refsource_CONFIRM

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000