CVE-2026-22046: 
Homebrew vulnerability analysis and mitigation

CVE-2026-22046 is a heap-buffer-overflow vulnerability in the iccDEV library, specifically in the CIccProfileXml::ParseBasic() function at IccXML/IccLibXML/IccProfileXml.cpp:361. iccDEV is an open-source set of libraries and tools maintained by the International Color Consortium (ICC) for interacting with and applying ICC color management profiles. All versions prior to 2.3.1.2 are affected. The vulnerability was reported by researcher xsscx on January 6, 2026, and publicly disclosed via a GitHub security advisory on January 7, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause involves multiple weaknesses: improper input validation (CWE-20), improper handling of length parameter inconsistency (CWE-130), unchecked return values (CWE-252), and type confusion (CWE-843). The specific trigger is a typo in the parsing logic where a NULL pointer check was performed instead of a NULL character check, causing the parser to read one byte beyond a heap-allocated buffer when processing a malformed XML-based ICC color profile. Exploitation requires an attacker to craft a malicious ICC profile file (in XML format) and deliver it to a victim who then processes it using an application linked against the vulnerable iccDEV library — for example, via the iccFromXml command-line tool. The issue was reproduced using AddressSanitizer (ASAN) with a publicly available XML test input derived from CVE-2024-38427 (GitHub Issue #448, GitHub PR #451).

Successful exploitation can result in high confidentiality, integrity, and availability impact on the affected system, potentially enabling arbitrary code execution with the privileges of the application using the iccDEV library. An attacker who achieves code execution could access sensitive data, modify files, or cause a denial of service (application crash). The scope is limited to the affected application process, but lateral movement is possible if the compromised application has elevated privileges or network access (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit or evidence of active in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.055%, indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must open or process a maliciously crafted ICC profile file — which reduces the likelihood of mass exploitation (GitHub Advisory).

1. Craft a malicious ICC XML profile: Create or modify an XML-formatted ICC color profile to include malformed length fields or data structures that trigger the NULL character vs. NULL pointer check bug in CIccProfileXml::ParseBasic() at line 361 of IccProfileXml.cpp. A publicly available test vector (derived from CVE-2024-38427) has been demonstrated to trigger this condition.
2. Deliver the malicious file: Distribute the crafted .xml ICC profile to a target user via email attachment, file share, web download, or any other file delivery mechanism.
3. Trigger processing: Induce the victim to process the malicious file using an application linked against the vulnerable iccDEV library (e.g., the iccFromXml command-line tool or any application that imports ICC profiles).
4. Trigger heap-buffer-overflow: When CIccProfileXml::ParseBasic() parses the malformed profile, it performs an out-of-bounds READ of 1 byte on the heap, potentially corrupting memory or enabling controlled code execution depending on heap layout.
5. Achieve code execution: Depending on heap state and memory layout, the overflow may be leveraged to redirect execution flow, enabling arbitrary code execution with the privileges of the invoking process (GitHub Issue #448, GitHub PR #451).

• Process: Unexpected crashes or abnormal termination of applications using the iccDEV library when processing ICC profile files; ASAN/sanitizer output referencing CIccProfileXml::ParseBasic() at IccProfileXml.cpp:361.
• File System: Presence of unexpected or externally sourced .xml ICC profile files (especially those with anomalous length fields or malformed headers) in directories processed by iccDEV-linked applications.
• Logs: Application crash logs or core dumps referencing heap-buffer-overflow in CIccProfileXml::ParseBasic() or CIccProfileXml::ParseXml(); error messages from AddressSanitizer indicating READ of size 1 at unexpected heap addresses.
• Network: Unusual downloads of .xml ICC profile files from untrusted or unknown external sources to systems running iccDEV-linked applications (GitHub Issue #448).

The fix is available in iccDEV version 2.3.1.2, which corrects the NULL character vs. NULL pointer check typo in CIccProfileXml::ParseBasic(). Organizations should upgrade to version 2.3.1.2 or later as the primary remediation. No configuration-based workarounds are available. As interim measures, restrict user ability to process untrusted or unknown ICC color profile files, validate ICC profile sources, and consider sandboxing or isolating iccDEV library operations when handling external profiles (GitHub Advisory, GitHub PR #451).

The vulnerability was reported and remediated rapidly, with the fix merged on January 6, 2026, and the security advisory published the following day. The Hacker Wire covered the disclosure with a dedicated article (The Hacker Wire), and the CVE was included in CISA's weekly vulnerability bulletin for the week of January 5, 2026. Social media coverage was limited to automated CVE tracking accounts on Mastodon and Bluesky. No significant independent researcher commentary or broader community debate was observed.