CVE-2026-21679 is a heap buffer overflow in iccDEV, the ICC color profile library, scored 8.8 (High). Opening a crafted profile can trigger it in CIccLocalizedUnicode::GetText(). The advisory lists 2.3.1.2 as the patched version and offers no workaround, so update any tool or service that parses ICC profiles.
What's affected
- Product: iccDEV, libraries and tools for ICC color profiles (International Color Consortium)
- Affected: versions before 2.3.1.2. The GitHub advisory lists affected versions as below 2.3.1.1, and the NVD text says prior to 2.3.1.2
- Fixed: 2.3.1.2
- Workarounds: none provided in the advisory
- Status: not in the CISA Known Exploited Vulnerabilities catalog
The two statements about affected versions differ by one patch number. Since 2.3.1.2 is the version that contains the fix, use that as your target.
How to check if you're exposed
iccDEV is usually built from source or vendored into another project, so it will not always appear in a package manager listing. Look at where it comes from:
git -C path/to/iccDEV describe --tags
grep -rIl "CIccLocalizedUnicode" . 2>/dev/null | head
The first command shows the tag of a checkout. The second finds source trees that bundle the class named in the advisory. For prebuilt tools, check the version output or the release notes of whatever ships the library.
Next, ask where profiles come from. The CVSS vector needs user interaction, which in practice means someone opens a profile. A service that processes uploaded images or documents is more exposed than a desktop tool used on files you made yourself.
What to do now
- List every project and image that builds or bundles iccDEV, including vendored copies.
- Update to 2.3.1.2 or later and rebuild anything that links against it.
- Where you cannot update yet, stop accepting ICC profiles from untrusted sources in services that parse them.
- Run profile parsing as an unprivileged user in a sandbox or container so a crash or memory fault has little to reach.
- Add the fixed version to your build checks so an older copy cannot be pulled in again.
Why it matters
A heap buffer overflow happens when code writes or reads past the end of a block of memory it allocated. The record classes this under CWE-20, improper input validation, and CWE-787, out-of-bounds write. The function named in the advisory handles text stored in a profile. If the stored length and the buffer do not agree, the code can step outside the buffer.
ICC profiles are small files embedded in photos, PDFs and print workflows, which makes parsers for them easy to forget. Any pipeline that reads images from outside, such as an upload form or a document converter, may be calling a color library without anyone listing it as a dependency.
Because the library is often compiled into other software, the question to ask is not only whether you use iccDEV but also which of your tools contain it. Reachability analysis helps here: it tells you whether your code actually calls the vulnerable function, so the fix lands where it matters first.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a workaround?
The advisory says none is provided. Update to 2.3.1.2 or later.
What does user interaction required mean here?
The vector expects someone to open or process a crafted profile. Automated services that process files count, so treat upload paths as exposed.
Sources
Last reviewed: 19 October 2026.
