CVE-2026-21674: iccDEV Memory Leak Vulnerability

CVE-2026-21674 Overview

CVE-2026-21674 is a memory leak vulnerability affecting iccDEV, a library suite for working with ICC color management profiles. The vulnerability exists in versions 2.3.1 and below within the XML MPE Parsing Path (iccFromXml). When parsing malformed or specially crafted XML input, the CIccProfileXml::ParseTag() function fails to properly deallocate memory for tag objects under certain error conditions, leading to memory exhaustion over time.

Critical Impact
Applications processing untrusted ICC profile XML data may experience denial of service through memory exhaustion due to improper memory management in the parsing routine.

Affected Products

iccDEV versions 2.3.1 and below
Applications utilizing the IccLibXML component for XML-based ICC profile parsing
Software integrating the iccFromXml parsing functionality

Discovery Timeline

January 6, 2026 - CVE-2026-21674 published to NVD
January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21674

Vulnerability Analysis

This vulnerability falls under CWE-401 (Missing Release of Memory after Effective Lifetime). The flaw resides in the CIccProfileXml::ParseTag() function within IccXML/IccLibXML/IccProfileXml.cpp. When the XML parsing encounters an error condition after allocating a pTag object, the function returns false without first releasing the allocated memory. This creates a memory leak that accumulates with each failed parsing attempt.

The vulnerability requires local access and user interaction—specifically, an attacker must convince a user or automated process to parse a maliciously crafted XML file. While the impact is limited to availability (denial of service through resource exhaustion), applications that process numerous ICC profiles in batch operations or accept untrusted profile data are particularly susceptible.

Root Cause

The root cause is improper memory management in the error handling path of the XML tag parsing routine. When validation fails after a tag object has been instantiated but before it has been successfully integrated into the profile structure, the code path exits without invoking delete pTag, resulting in orphaned memory allocations. This classic resource leak pattern occurs because the error handling code was incomplete, missing the necessary cleanup operation before returning from the function.

Attack Vector

The attack vector is local, requiring an attacker to provide a specially crafted XML file containing malformed ICC profile data. The exploitation scenario involves:

An attacker creates an XML file with intentionally malformed tag definitions that trigger the error condition
The target application attempts to parse the malicious XML using the vulnerable iccFromXml pathway
Each parsing attempt leaks memory as tag objects are allocated but never freed
Repeated processing of malicious files leads to memory exhaustion and potential denial of service

cpp

           parseStr += nodeName;
           snprintf(str, strSize, ") Tag on line %d\n", pTypeNode->line);
           parseStr += str;
+          delete pTag;
           return false;
         }
       }

Source: GitHub Commit d7028d8

The patch adds the critical delete pTag; statement before the function returns false, ensuring proper cleanup of the allocated tag object when parsing fails.

Detection Methods for CVE-2026-21674

Indicators of Compromise

Gradual memory consumption increase in processes utilizing iccDEV XML parsing functionality
Application crashes or out-of-memory errors when processing ICC profile XML files
Unusual presence of malformed or suspicious XML files containing ICC profile data
Memory profiler reports showing unreleased allocations in CIccProfileXml::ParseTag()

Detection Strategies

Monitor memory usage patterns for applications that process ICC color profiles via XML parsing
Implement static analysis tools to identify CWE-401 patterns in codebases using iccDEV
Review application logs for repeated XML parsing failures that could indicate exploitation attempts
Use memory leak detection tools such as Valgrind or AddressSanitizer during testing

Monitoring Recommendations

Configure resource monitoring alerts for abnormal memory growth in ICC profile processing services
Implement rate limiting on ICC profile XML parsing operations to mitigate denial of service risk
Audit input sources for ICC profile XML data to identify potentially malicious file origins
Deploy runtime application self-protection (RASP) solutions capable of detecting memory exhaustion patterns

How to Mitigate CVE-2026-21674

Immediate Actions Required

Upgrade iccDEV to version 2.3.1.1 or later which contains the security fix
Review applications using iccDEV to identify affected deployments
Implement input validation to reject malformed XML before processing
Consider implementing memory usage limits for ICC profile parsing operations

Patch Information

The vulnerability has been addressed in iccDEV version 2.3.1.1. The fix adds proper memory deallocation in the error handling path of CIccProfileXml::ParseTag(). Security patch details are available in the GitHub commit d7028d8f558bb681efe2b85f02eb4ca374502cbb. Additional context is provided in the GitHub Security Advisory GHSA-xww6-v3vg-4qc7 and GitHub Issue #241.

Workarounds

Restrict ICC profile XML parsing to trusted input sources only until patching is complete
Implement resource limits (memory caps) on processes that handle ICC profile parsing
Use process isolation or containerization to limit the impact of memory exhaustion
Configure application restarts or watchdog processes to recover from memory exhaustion conditions

bash

# Configuration example - Setting memory limits for processes using iccDEV
# Using systemd service configuration
[Service]
MemoryMax=512M
MemoryHigh=384M
Restart=on-failure
RestartSec=30