CVE-2026-22047: 
Homebrew vulnerability analysis and mitigation

CVE-2026-22047 is a heap-buffer-overflow vulnerability in the iccDEV library, specifically in the SIccCalcOp::Describe() function at IccProfLib/IccMpeCalc.cpp (line 1816/2988). It affects all iccDEV versions prior to 2.3.1.2 and was disclosed on January 7, 2026, with a patch released the same day. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is improper input validation (CWE-20) combined with improper handling of length parameter inconsistency (CWE-130) and unchecked return values (CWE-252), resulting in an out-of-bounds write/read (CWE-787) in the CIccCalculatorFunc::DescribeSequence() function. Specifically, the fix addressed an incorrect limit on the number of ops processed, causing a buffer overread when parsing crafted ICC color profile data. An attacker can trigger the overflow by supplying a malicious .icc file that, when processed by a tool such as iccToXml, causes AddressSanitizer to report a READ of size 4 beyond the heap buffer at IccMpeCalc.cpp:1816. Exploitation requires user interaction — a user or automated pipeline must open or process the malicious ICC profile (GitHub Issue #454, GitHub PR #459).

Successful exploitation can result in high confidentiality impact (disclosure of heap memory contents), high integrity impact (potential modification of application state), and high availability impact (application crash or denial of service). Any application or pipeline that uses the iccDEV library to process ICC color profiles from untrusted sources is at risk. While lateral movement potential is limited given the user-interaction requirement, memory disclosure could expose sensitive in-process data (GitHub Advisory).

A proof-of-concept exploit in the form of a crafted ICC profile file is publicly available on GitHub, referenced in the original issue report (GitHub Issue #454). The PoC file can be retrieved from the xsscx/Commodity-Injection-Signatures repository and used directly with the iccToXml tool to reproduce the crash. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.055% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Obtain the malicious ICC profile: Download the crafted PoC ICC file from the public repository: wget https://github.com/xsscx/Commodity-Injection-Signatures/raw/refs/heads/master/graphics/icc/SIccCalcOp-Describe-IccProfLib-IccMpeCalc_cpp_L1816.icc
2. Identify a vulnerable target: Confirm the target system is running iccDEV version prior to 2.3.1.2 and has tools such as iccToXml built against the vulnerable library.
3. Deliver the malicious file: Provide the crafted .icc file to the target user or automated ICC-processing pipeline (e.g., via email attachment, web upload, or shared storage).
4. Trigger processing: The victim (or automated process) runs iccToXml SIccCalcOp-Describe-IccProfLib-IccMpeCalc_cpp_L1816.icc output.xml, which invokes SIccCalcOp::Describe() and CIccCalculatorFunc::DescribeSequence().
5. Heap buffer overflow occurs: The library reads 4 bytes beyond the allocated heap buffer at IccMpeCalc.cpp:1816, potentially crashing the application or, in a more targeted scenario, enabling memory disclosure or code execution depending on heap layout (GitHub Issue #454, GitHub PR #459).

• File System: Presence of unexpected .icc files in user download directories, temp folders, or ICC profile processing directories, particularly files with unusual sizes or names referencing SIccCalcOp or IccMpeCalc.
• Process: Abnormal termination (crash/segfault) of applications using iccDEV (e.g., iccToXml, iccApplyProfiles) when processing ICC files from external sources; AddressSanitizer output referencing heap-buffer-overflow at IccProfLib/IccMpeCalc.cpp:1816.
• Logs: Application crash logs or core dumps generated by ICC profile processing tools; error messages referencing SIccCalcOp::Describe() or CIccCalculatorFunc::DescribeSequence().
• Network: Downloads of .icc files from untrusted or unknown external sources, particularly from raw GitHub content URLs associated with the xsscx/Commodity-Injection-Signatures repository (GitHub Issue #454).

Upgrade iccDEV to version 2.3.1.2 or later, which contains the fix merged via pull request #459 on January 7, 2026 (GitHub PR #459). No workarounds are available for unpatched versions. As an interim measure, organizations should restrict processing of ICC color profiles from untrusted or external sources until the upgrade is applied (GitHub Advisory).

The vulnerability was reported and patched on the same day (January 7, 2026) by researcher xsscx and fixed by contributor ChrisCoxArt, demonstrating a rapid coordinated disclosure within the iccDEV project (GitHub PR #459). Brief coverage appeared on security aggregators including The Hacker Wire and INCIBE-CERT, and the CVE was noted in the CISA vulnerability bulletin for the week of January 5, 2026. Community reaction was limited given the niche scope of the library.