Unrated severityNVD Advisory· Published Jan 7, 2026· Updated Jan 7, 2026

NULL Pointer Dereference in iccDEV XML Tag Parser

CVE-2026-21502

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the XML tag parser. This issue has been patched in version 2.3.1.2.

Affected products

iccDEV/iccDEVllm-fuzzy
Range: < 2.3.1.2
InternationalColorConsortium/iccDEVv5
Range: < 2.3.1.2

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/InternationalColorConsortium/iccDEV/commit/d04c236775e89a029f93efcc242fdb1fbc245a1cmitrex_refsource_MISC
github.com/InternationalColorConsortium/iccDEV/commit/d9e42a1fb2606e25e498eb94f34f6da89f522e35mitrex_refsource_MISC
github.com/InternationalColorConsortium/iccDEV/issues/368mitrex_refsource_MISC
github.com/InternationalColorConsortium/iccDEV/pull/407mitrex_refsource_MISC
github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-67r8-q3mh-42j6mitrex_refsource_CONFIRM

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000