CVE-2026-21500
- EPSS 0.04%
- Veröffentlicht 07.01.2026 17:09:35
- Zuletzt bearbeitet 09.01.2026 22:00:11
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginStack Overflow in iccDEV XML Calculator Macro Expansion
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to stack overflow in the XML calculator macro expansion. This issue has been patched in version 2.3.1.2.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.04% | 0.124 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| security-advisories@github.com | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
|
The code uses too many unconditional branches (such as "goto").
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
The product writes data past the end, or before the beginning, of the intended buffer.