CVE-2026-21493
6.6
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Exploitability: 1.8 / Impact: 4.7
Source: security-advisories@github.com (Secondary)
Description
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3.1.2.
Affected (1)
Related CWEs
CWE-188
Reliance on Data/Memory Layout
The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.
CWE-703
Improper Check or Handling of Exceptional Conditions
The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
References (3)
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
ExploitIssue TrackingVendor Advisory
Source: security-advisories@github.com
PatchVendor Advisory
Timeline
No history available yet.