CVE-2026-21674

Low · 3.3

CVSS

3.3

EPSS

0.2%

Published

Jan 6, 2026

CISA due date

—

The record

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a memory leak vulnerability in its XML MPE Parsing Path (iccFromXml). This issue is fixed in version 2.3.1.1.

Affected packages

Ecosystem	Package	Introduced	Fixed