CVE-2026-21504

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap buffer overflow in the ToneMap parser. This issue has been patched in version 2.3.1.2.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-193 CWE-787

Affected software

Vendor	Product	Versions
InternationalColorConsortium	iccDEV	< 2.3.1.2

References

Timeline

Published: Jan 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-215057.8iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-215065.5iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles.CVE-2026-215077.5iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have an infinite loop CVE-2026-215087.0Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-215097.8Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally CVE-2026-21517.2A vulnerability has been found in D-Link DIR-615 4.10. This affects an unknown part of the file adv_firewall.php of the component DMZ Host F CVE-2026-215108.8Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-215117.5Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.CVE-2026-215126.5Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.CVE-2026-215138.8Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-215147.8Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature lo CVE-2026-215159.9Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a n