CVE-2026-21675 Linux systems using the IccProfLib library are also affected by this vulnerability! (8 Jan 2026)

Published: 2026-01-05

Preface: Website hosting itself does not “provide” ICC profiles; instead, it stores the image files you upload, which may contain embedded ICC profiles. However, the key is how web browsers interpret them. Most standard browsers default to or prioritize the sRGB color space for displaying web page content, so explicit ICC profiles are usually unnecessary and can sometimes even negatively impact file size/performance. Therefore, ideally, you should set it to “RGB” format.

However, ICC profiles are crucial for accurate color reproduction in facial recognition systems, especially for ensuring consistency between capture (camera/scanner) and analysis (software/display), because they provide the necessary color translation for accurate skin tone mapping, feature differentiation (like subtle shadows and highlights), and reliable matching, preventing errors caused by device-specific color variations that could affect algorithm performance.

Background: IccProfLib is an open-source, cross-platform C++ library from the SampleICC project that allows developers to read, write, manipulate, and apply ICC (International Color Consortium) profiles, which define device-specific color characteristics for consistent color management in graphics. The ICC profile must always be saved with your photos for the same reason. Without it, the device reproducing your photos (printer, computer screen, phone screen, etc) doesn’t have the exact instructions for how the colours should look.

In 2026, ICC (International Color Consortium) profiles are essential for maintaining color accuracy across devices on Windows. The IccProfLib C++ library is designed for cross-platform compatibility, so it can be used on Linux.

A Hint Manager, often part of a Color Management System (CMS), uses these profiles to adjust color data, interpreting the profile’s instructions to render colors accurately.

Remark: ICC profiles can be for greyscale, extended gamut 7 colour colours and other colour combinations, well as the more common RGB and CMYK profiles.

Vulnerability details: iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in the CIccXform::Create() function, where it deletes the hint. This issue is fixed in version 2.3.1.1.

Official announcement: Please refer to the link for details

https://www.tenable.com/cve/CVE-2026-21675

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.