CVE-2026-21675

Critical · 9.8

CVSS

9.8

EPSS

0.4%

Published

Jan 6, 2026

CISA due date

—

The record

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.

Affected packages

Ecosystem	Package	Introduced	Fixed