rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-21656 Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Johnson Controls
product: Frick Controls Quantum HD
default_status: unaffected
Credits: lang: en
value: Noam Moshe of Claroty Team 82 Research group
Published: 2026-02-27T08:47:21.490Z
CVE-2026-21657 Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Johnson Controls
product: Frick Controls Quantum HD
default_status: unaffected
Credits: lang: en
value: Noam Moshe of Claroty Team 82 Research group
Published: 2026-02-27T08:54:28.236Z
CVE-2026-21658 Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Johnson Controls
product: Frick Controls Quantum HD
default_status: unaffected
Credits: lang: en
value: Noam Moshe of Claroty Team 82 Research group
Published: 2026-02-27T08:59:13.878Z
CVE-2026-21659 Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion
Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to
execute arbitrary code on the affected device, leading to full system compromise. 
This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: Johnson Controls
product: Frick Controls Quantum HD
default_status: unaffected
Credits: lang: en
value: Noam Moshe of Claroty Team 82 Research group
Published: 2026-02-27T09:08:50.498Z
CVE-2026-21660 Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware
Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise
This issue affects Frick Controls Quantum HD version 10.22 and prior.
Problem types: cwe_id: CWE-256
description: CWE-256: Plaintext Storage of a Password
Affected products: vendor: Johnson Controls
product: Frick Controls Quantum HD
default_status: unaffected
Credits: lang: en
value: Noam Moshe of Claroty Team 82 Research group
Published: 2026-02-27T09:18:49.186Z
CVE-2026-21661 AC2000 Uncontrolled Search Path Element
Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths.

This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: JohnsonControls
product: AC2000
default_status: unaffected
Published: 2026-05-06T16:21:13.885Z
CVE-2026-21663 
HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.
Affected products: vendor: Revive
product: Revive Adserver
default_status: unaffected
Published: 2026-01-20T20:48:47.974Z
CVE-2026-21664 
HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.
Affected products: vendor: Revive
product: Revive Adserver
default_status: unaffected
Published: 2026-01-20T20:48:47.976Z
CVE-2026-21665 
The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 2021.2.4 (build 4.7.3155.0011) uses deprecated .NET Remoting TCP channels that allow unsafe deserialization of untrusted data. When these services are exposed to an untrusted network in a client-managed deployment, an unauthenticated attacker can achieve remote code execution. Version 2021.2.4 is no longer supported by Fiserv. Customers should upgrade to a currently supported release (2025.1 or later) and ensure that .NET Remoting service ports are not exposed beyond trusted network boundaries.

This CVE documents behavior observed in a client-hosted deployment running an unsupported legacy version of Originate Loans Peripherals with .NET Remoting ports exposed to an untrusted network. This is not a default or supported configuration. Customers running legacy versions should upgrade to a currently supported release and ensure .NET Remoting ports are restricted to trusted network segments. The finding does not apply to Fiserv-hosted environments.
Affected products: vendor: Fiserv
product: Originate Loans Peripherals (formerly Velocity Services) -- Print Service component
default_status: unaffected
Credits: lang: en
value: Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp.
lang: en
value: Omar Crespo, Pentester, GM Sectec, Corp.
lang: en
value: VulnCheck
Published: 2026-02-23T22:34:39.632Z
CVE-2026-21666 
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
Affected products: vendor: Veeam
product: Backup and Replication
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
baseScore: 10
baseSeverity: CRITICAL
Published: 2026-03-12T15:09:39.180Z
CVE-2026-21667 
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
Affected products: vendor: Veeam
product: Backup and Replication
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
baseScore: 10
baseSeverity: CRITICAL
Published: 2026-03-12T15:09:39.148Z
CVE-2026-21668 
A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup Repository.
Affected products: vendor: Veeam
product: Backup and Replication
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Published: 2026-03-12T15:09:39.335Z
CVE-2026-21669 
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
Affected products: vendor: Veeam
product: Backup and Replication
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
baseScore: 10
baseSeverity: CRITICAL
Published: 2026-03-12T15:09:39.284Z
CVE-2026-21670 
A vulnerability allowing a low-privileged user to extract saved SSH credentials.
Affected products: vendor: Veeam
product: Backup and Replication
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
baseScore: 7.7
baseSeverity: HIGH
Published: 2026-03-12T15:09:39.200Z
CVE-2026-21671 
A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.
Affected products: vendor: Veeam
product: Software Appliance
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
baseScore: 9.1
baseSeverity: CRITICAL
Published: 2026-03-12T15:09:39.209Z
CVE-2026-21672 
A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.
Problem types: cwe_id: CWE-538
description: CWE-538 File and Directory Information Exposure
Affected products: vendor: Veeam
product: Backup and Replication
default_status: unaffected
Published: 2026-03-12T16:26:52.213Z
CVE-2026-21673 iccDEV has Integer Overflow/Underflow in CIccXmlArrayType::ParseTextCountNum()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have overflows and underflows in  CIccXmlArrayType::ParseTextCountNum(). This vulnerability affects users of the iccDEV library who process ICC color profiles. This issue is fixed in version 2.3.1.1.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
cwe_id: CWE-681
description: CWE-681: Incorrect Conversion between Numeric Types
cwe_id: CWE-704
description: CWE-704: Incorrect Type Conversion or Cast
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-06T01:32:21.632Z
CVE-2026-21674 iccDEV has a Memory Leak in its CIccProfileXml::ParseTag() Error Path
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a memory leak vulnerability in its XML MPE Parsing Path (iccFromXml). This issue is fixed in version 2.3.1.1.
Problem types: cwe_id: CWE-401
description: CWE-401: Missing Release of Memory after Effective Lifetime
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2026-01-06T01:38:12.045Z
CVE-2026-21675 iccDEV has a Use After Free vulnerability in CIccCmm class via improper hint manager object deletion
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-06T01:43:24.726Z
CVE-2026-21676 iccDEV has a Heap-based Buffer Overflow in its CIccMBB::Validate() function
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have a Heap-based Buffer Overflow in its CIccMBB::Validate function which checks tag data validity. This issue is fixed in version 2.3.1.1.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-06T03:07:36.282Z
CVE-2026-21677 iccDEV has Undefined Behavior in CIccCLUT::Init()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have Undefined Behavior in its CIccCLUT::Init function which initializes and sets the size of a CLUT. This issue is fixed in version 2.3.1.1.
Problem types: cwe_id: CWE-758
description: CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-06T03:11:30.537Z
CVE-2026-21678 iccDEV has heap-buffer-overflow vulnerability on IccTagXml()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap-buffer-overflow vulnerability in IccTagXml(). This issue has been patched in version 2.3.1.2.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-07T17:11:07.269Z
CVE-2026-21679 iccDEV has heap-buffer-overflow vulnerability in CIccLocalizedUnicode::GetText()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to heap-buffer-overflow in CIccLocalizedUnicode::GetText(). This issue has been patched in version 2.3.1.2.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-07T17:11:16.385Z
CVE-2026-21680 iccDEV has Null Pointer Dereference in CIccProfile::CheckTagTypes()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a NULL pointer dereference vulnerability. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-01-07T17:50:09.188Z
CVE-2026-21681 iccDEV has Undefined Behavior runtime error: nan is outside the range .. IccProfLib/IccTagBasic.cpp
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Undefined Behavior runtime error. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
version: 3.1
Published: 2026-01-07T20:48:57.511Z
CVE-2026-21682 iccDEV has heap-buffer-overflow in CIccXmlArrayType::ParseText()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a heap-buffer-overflow in `CIccXmlArrayType::ParseText()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-07T20:58:07.355Z
CVE-2026-21683 iccDEV has Type Confusion in icStatusCMM::CIccEvalCompare::EvaluateProfile()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `icStatusCMM::CIccEvalCompare::EvaluateProfile()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-07T21:12:45.950Z
CVE-2026-21684 iccDEV has Undefined Behavior in CIccTagSpectralViewingConditions()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagSpectralViewingConditions()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-758
description: CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
version: 3.1
Published: 2026-01-07T21:18:31.527Z
CVE-2026-21685 iccDEV has Undefined Behavior in CIccTagLut16::Read()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagLut16::Read()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-758
description: CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
version: 3.1
Published: 2026-01-07T21:23:41.134Z
CVE-2026-21686 iccDEV has Undefined Behavior in CIccTagLutAtoB::Validate()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagLutAtoB::Validate()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-758
description: CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
version: 3.1
Published: 2026-01-07T21:25:57.567Z
CVE-2026-21687 iccDEV has Undefined Behavior in CIccTagCurve::CIccTagCurve()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagCurve::CIccTagCurve()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-758
description: CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
version: 3.1
Published: 2026-01-07T21:32:13.792Z