CVE-2026-21674 LOW

CVE-2026-21674: iccDEV has a Memory Leak in its CIccProfileXml::ParseTag() Error Path

Vendor Internationalcolorconsortium

Product iccDEV

Weakness CWE-401

Published January 6, 2026

Last update January 6, 2026

View on NVD All CVEs

CVSS base score

3.3/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a memory leak vulnerability in its XML MPE Parsing Path (iccFromXml). This issue is fixed in version 2.3.1.1.

Key dates

02Disclosure timeline

January 6, 2026 CVE published

January 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-21674 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/401.html

Related vulnerabilities

04Related CVE

CVE-2022-23585 Memory leak in decoding PNG images in Tensorflow CVE-2026-34052 LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service) CVE-2026-35424 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability CVE-2025-29910 CryptoLib's crypto_handle_incrementing_nontransmitted_counter Function has Memory Leak CVE-2026-35505 OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime