CVE-2026-21504: 
Homebrew vulnerability analysis and mitigation

CVE-2026-21504 is a heap buffer overflow vulnerability in the ToneMap parser of iccDEV, a set of libraries and tools for interacting with ICC color management profiles maintained by the International Color Consortium. All versions prior to 2.3.1.2 are affected. The vulnerability was reported on December 29, 2025, patched on January 2, 2026, and publicly disclosed on January 7, 2026. It carries a CVSS v3.1 base score of 7.8 (High) per NVD, and 6.6 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause is an off-by-one loop increment error (CWE-193) in CIccMpeToneMap::Read() within IccProfLib/IccMpeBasic.cpp at line 4556. The inner loop incorrectly increments i instead of j (for (j = 0; j < i; i++) instead of for (j = 0; j < i; j++)), causing the loop counter to advance beyond the allocated bounds of the funcPos array and resulting in a heap buffer overflow (CWE-122, CWE-787). Exploitation requires a user to process a specially crafted malicious ICC color profile file, triggering the out-of-bounds read of 4 bytes immediately past a 24-byte heap-allocated region. A proof-of-concept ICC file and AddressSanitizer crash output are publicly available in the GitHub issue report (GitHub Issue, Fix Commit).

Successful exploitation can result in high availability impact (denial of service/crash), with low confidentiality and integrity impacts, as the out-of-bounds read may expose heap memory contents or corrupt adjacent data. The vulnerability affects any application or pipeline that uses the iccDEV library to parse ICC color profiles, including command-line tools such as iccDumpProfile. Because local access and user interaction are required, the risk of broad lateral movement is limited, but the vulnerability could be leveraged in targeted attacks where a victim is tricked into opening a malicious ICC profile (GitHub Advisory, Feedly).

A proof-of-concept exploit in the form of a crafted ICC profile file is publicly available via the GitHub issue report and the xsscx Commodity Injection Signatures repository. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.012% (0.000120), reflecting low probability of near-term exploitation. Exploitation requires local access and user interaction, limiting the attack surface (GitHub Issue, Feedly).

1. Craft or obtain a malicious ICC profile: Download or create a specially crafted ICC color profile file designed to trigger the off-by-one loop error in CIccMpeToneMap::Read(). A public PoC file is available at https://github.com/xsscx/Commodity-Injection-Signatures/raw/refs/heads/master/graphics/icc/CIccMpeToneMap_IccProfLib_IccMpeBasic.cpp-L4532.icc.
2. Social engineering: Convince a target user to open or process the malicious ICC profile using an application built on the vulnerable iccDEV library (e.g., iccDumpProfile).
3. Trigger the vulnerability: When the application parses the ToneMap element of the ICC profile, the inner loop in CIccMpeToneMap::Read() increments i instead of j, causing the loop to read 4 bytes past the end of the heap-allocated funcPos array.
4. Achieve impact: The out-of-bounds read causes an application crash (denial of service) and may expose adjacent heap memory contents, potentially leaking sensitive data depending on heap layout (GitHub Issue, GitHub Advisory).

• File System: Presence of unexpected or unknown .icc profile files in user directories or application input folders, particularly files with anomalous ToneMap element structures.
• Process: Abnormal termination (crash/abort) of applications using the iccDEV library (e.g., iccDumpProfile) when processing ICC profile files; AddressSanitizer output referencing heap-buffer-overflow in CIccMpeToneMap::Read() at IccProfLib/IccMpeBasic.cpp:4557.
• Logs: Application crash logs or core dumps referencing CIccMpeToneMap::Read(), CIccTagMultiProcessElement::Read(), or CIccProfile::LoadTag() in the stack trace; error messages from ASan such as heap-buffer-overflow on address ... READ of size 4 (GitHub Issue).

Upgrade iccDEV to version 2.3.1.2 or later, which contains the fix introduced in commits 14fe378 and 23a38f8. The fix corrects the inner loop variable from i++ to j++ in CIccMpeToneMap::Read() — a single-byte, single-bit change. No official workarounds are provided by the vendor; as an interim measure, restrict processing of untrusted or unknown ICC color profile files and implement input validation for ICC profile data. Monitor systems running versions prior to 2.3.1.2 for suspicious crashes related to ICC profile parsing (GitHub Advisory, Fix Commit).

The vulnerability was reported by security researcher xsscx and remediated by ChrisCoxArt (a contributor), who noted it was "probably the smallest fix I've ever made: 1 byte, difference of 1 bit." The fix was reviewed and merged promptly within days of the report. No significant broader media coverage or notable community discussion beyond the GitHub repository has been identified (GitHub PR).