Medium severity5.5NVD Advisory· Published Jan 7, 2026· Updated Jun 17, 2026

CVE-2026-21500

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to stack overflow in the XML calculator macro expansion. This issue has been patched in version 2.3.1.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Color (software)/Iccdev
cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*
Range: <2.3.1.2
International Color Consortium/iccDEVllm-fuzzy2 versions
<2.3.1.2+ 1 more
- (no CPE)range: <2.3.1.2
- (no CPE)range: < 2.3.1.2

Patches

Vulnerability mechanics

References

github.com/InternationalColorConsortium/iccDEV/commit/cce5f9b68a6c067b7ef898ccd5b000770745fb14nvdPatch
github.com/InternationalColorConsortium/iccDEV/commit/f295826a6f15add90490030f23b2ddd8593bff5bnvdPatch
github.com/InternationalColorConsortium/iccDEV/issues/384nvdExploitIssue Tracking
github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-4h4j-mm9w-2cp4nvdThird Party Advisory
github.com/InternationalColorConsortium/iccDEV/pull/406nvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000