CVE-2026-21495: iccDEV TIFF Reader DoS Vulnerability

CVE-2026-21495 Overview

CVE-2026-21495 is a division by zero vulnerability affecting iccDEV, a set of libraries and tools that enable interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, the TIFF Image Reader component in iccDEV fails to properly validate image parameters, allowing an attacker to trigger a division by zero condition through a maliciously crafted TIFF file.

Critical Impact

Exploitation of this vulnerability allows an attacker to cause application crashes through denial of service when processing specially crafted TIFF images with corrupted or zero-value parameters.

Affected Products

• iccDEV versions prior to 2.3.1.2
• Applications using the iccDEV TIFF Image Reader component
• Systems processing ICC color management profiles from untrusted TIFF sources

Discovery Timeline

• 2026-01-07 - CVE CVE-2026-21495 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21495

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the TIFF image processing functionality within iccDEV. The TIFF Image Reader component fails to validate critical image parameters before using them in arithmetic operations, specifically m_nRowsPerStrip, m_nSamples, and m_nBitsPerSample. When these values are zero (either from a corrupted file or malicious manipulation), subsequent division operations result in undefined behavior, typically manifesting as application termination.

The vulnerability is locally exploitable, requiring user interaction to open a malicious TIFF file. While it does not permit arbitrary code execution or information disclosure, successful exploitation results in complete denial of service to the affected application.

Root Cause

The root cause is insufficient validation of TIFF metadata fields before performing calculations that depend on those values. The TiffImg.cpp file retrieves various TIFF tags including rows per strip, samples per pixel, and bits per sample directly from the file without verifying they contain valid, non-zero values. These parameters are subsequently used as divisors in image processing calculations, leading to division by zero when they contain zero values.

Attack Vector

The attack requires local access and user interaction. An attacker must craft a malicious TIFF file with manipulated metadata fields set to zero values, then convince a victim to open the file using an application that relies on the vulnerable iccDEV library. When the TIFF Image Reader attempts to process the file, it reads the corrupted parameters and triggers a division by zero condition during image calculations, causing the application to crash.

// Security patch from TiffImg.cpp
// Source: https://github.com/InternationalColorConsortium/iccDEV/commit/10c34179a0332a869c2b46e305a9cd23a6311dfe

   TIFFGetField(m_hTif, TIFFTAG_XRESOLUTION, &m_fXRes);
   TIFFGetField(m_hTif, TIFFTAG_YRESOLUTION, &m_fYRes);
   TIFFGetField(m_hTif, TIFFTAG_COMPRESSION, &m_nCompress);
+  
+  if (m_nRowsPerStrip == 0 || m_nSamples == 0 || m_nBitsPerSample == 0) {
+    // Corrupt parameters - can't read the file
+    // If the file is uncompressed, we might guess some of the values,
+    // but it would take a bit of testing to get right.  Probably not worth it.
+    Close();
+    return false;
+  }
+  
+  if (m_nRowsPerStrip > m_nHeight)
+    m_nRowsPerStrip = m_nHeight;    // best guess, to limit memory allocated
 
   //Validate what we expect to work with
   if ((m_nBitsPerSample==32 && nSampleFormat!=SAMPLEFORMAT_IEEEFP) ||

Detection Methods for CVE-2026-21495

Indicators of Compromise

• Unexpected application crashes when processing TIFF image files
• Crash dumps indicating division by zero exceptions in iccDEV library components
• TIFF files with suspicious metadata containing zero values for RowsPerStrip, SamplesPerPixel, or BitsPerSample fields
• Error logs showing abnormal TIFF processing failures

Detection Strategies

• Deploy file integrity monitoring for TIFF files entering the environment from untrusted sources
• Implement application crash monitoring to identify patterns of division by zero errors in image processing workflows
• Use static analysis tools to scan incoming TIFF files for malformed metadata before processing
• Monitor process termination events related to applications using iccDEV libraries

Monitoring Recommendations

• Enable application crash reporting and correlate crashes in image processing applications
• Implement logging at the file input layer to capture TIFF file metadata before processing
• Configure SentinelOne endpoint protection to monitor for suspicious file operations targeting image processing applications
• Establish baseline behavior for image processing workflows to detect anomalous crash patterns

How to Mitigate CVE-2026-21495

Immediate Actions Required

• Upgrade iccDEV to version 2.3.1.2 or later immediately
• Review any applications that integrate iccDEV libraries and plan update schedules
• Restrict processing of TIFF files from untrusted sources until patching is complete
• Implement input validation at the application layer as a defense-in-depth measure

Patch Information

The vulnerability has been addressed in iccDEV version 2.3.1.2. The patch adds explicit validation checks for critical TIFF parameters (m_nRowsPerStrip, m_nSamples, m_nBitsPerSample) immediately after reading them from the file. If any of these values are zero, the file is rejected as corrupt and processing is safely terminated. Additional bounds checking was also added to limit memory allocation when m_nRowsPerStrip exceeds the image height.

For complete patch details, refer to the GitHub Commit Update and the GitHub Security Advisory GHSA-xhrm-79rg-5784.

Workarounds

• Implement pre-processing validation to check TIFF files for zero-value metadata fields before passing to iccDEV
• Use sandboxing or containerization for applications processing untrusted TIFF files to limit crash impact
• Deploy application-level wrappers that catch division by zero exceptions and handle them gracefully
• Restrict user permissions to prevent opening TIFF files from untrusted sources in production environments

# Configuration example
# Validate TIFF file metadata before processing with iccDEV tools
# Check for zero values in critical TIFF tags using tiffinfo

tiffinfo -D image.tiff | grep -E "Rows/Strip:|Samples/Pixel:|Bits/Sample:" | \
  awk '{if ($2 == 0) {print "INVALID: " $0; exit 1}}'