CVE-2026-22255: 
Homebrew vulnerability analysis and mitigation

CVE-2026-22255 is a heap-buffer-overflow vulnerability in the CIccCLUT::Init() function within IccProfLib/IccTagLut.cpp of the iccDEV library, which provides tools for interacting with International Color Consortium (ICC) color management profiles. It affects all iccDEV versions prior to 2.3.1.2 and was disclosed on January 7–8, 2026, with a patch released the same day. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is a combination of improper input validation (CWE-20), improper handling of length parameter inconsistency (CWE-130), and unchecked return values (CWE-252) in the CIccCLUT::Init() function at IccTagLut.cpp:1862. Specifically, the function performs a memcpy without verifying that the size of the gridpoints array read from an ICC profile matches the expected number of input channels, allowing a heap buffer overflow when a maliciously crafted ICC profile is parsed. The fix, introduced in PR #469, adds a validation check ensuring the gridpoints array size is equal to or greater than the expected number of inputs, returning an error if they do not match. A proof-of-concept XML file (IccUtilXml_cpp-L1142-heap-buffer-overflow-poc.xml) was published by the reporter and can be used with the iccFromXml tool to reproduce the overflow (GitHub Issue, GitHub PR).

Successful exploitation can result in high confidentiality, integrity, and availability impacts, potentially enabling arbitrary code execution in the context of the application processing the malicious ICC profile. An attacker who tricks a user into loading a crafted ICC color profile can trigger the heap overflow, leading to memory corruption, application crashes, or full code execution. The scope is limited to the affected component, but depending on the application's privilege level, exploitation could facilitate data theft, data corruption, or service disruption (GitHub Advisory, Feedly).

A public proof-of-concept exploit file (IccUtilXml_cpp-L1142-heap-buffer-overflow-poc.xml) is available on GitHub and was used to demonstrate the vulnerability during responsible disclosure. There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.055%, indicating a low probability of exploitation in the near term. User interaction is required — a victim must open or process a malicious ICC profile — which somewhat limits the attack surface (GitHub Issue, Feedly).

1. Craft a malicious ICC profile: Create or obtain a specially crafted ICC profile XML file where the gridpoints array size is inconsistent with the declared number of input channels (e.g., using the public PoC: IccUtilXml_cpp-L1142-heap-buffer-overflow-poc.xml from the reporter's repository).
2. Deliver the malicious file: Distribute the crafted ICC profile to a target user via email attachment, web download, or embedding it in a document — any vector that causes the victim to open or process the file with an application using a vulnerable version of iccDEV (< 2.3.1.2).
3. Trigger ICC profile parsing: The victim opens the file or an application automatically processes it, invoking iccFromXml or another iccDEV-based tool that calls CIccCLUT::Init() during profile parsing.
4. Trigger heap-buffer-overflow: The CIccCLUT::Init() function at IccTagLut.cpp:1862 performs an __asan_memcpy (or equivalent memcpy) with a size derived from the malformed gridpoints array, writing beyond the allocated heap buffer.
5. Achieve code execution or crash: Depending on heap layout and memory protections, the overflow can corrupt adjacent heap metadata or function pointers, potentially enabling arbitrary code execution or causing a denial of service (GitHub Issue, GitHub Advisory).

• File System: Presence of unexpected or externally sourced ICC profile files (.icc, .icm) or XML-based ICC profile files (.xml) in user download directories or temporary folders, particularly files with mismatched gridpoints and input channel declarations.
• Process: Application crashes or abnormal termination of processes that use iccDEV (e.g., iccFromXml, color management daemons) with heap corruption error messages; AddressSanitizer output referencing CIccCLUT::Init at IccTagLut.cpp:1862.
• Logs: Error messages such as heap-buffer-overflow on address ... READ of size N in application logs or crash reports; stack traces referencing CIccCLUT::Init() in IccProfLib/IccTagLut.cpp (GitHub Issue).

Upgrade iccDEV to version 2.3.1.2 or later, which contains the fix introduced in PR #469 that validates gridpoints array size against the expected number of input channels before performing the copy operation. No configuration-based workarounds are available for vulnerable versions. As an interim measure, restrict processing of ICC color profiles from untrusted or external sources until the patch can be applied, and consider sandboxing applications that process ICC profiles (GitHub Advisory, GitHub PR).

The vulnerability was reported and patched on the same day (January 7, 2026) by researcher xsscx, with the fix contributed by ChrisCoxArt. The issue was triaged and merged rapidly by the iccDEV maintainers, reflecting a responsive disclosure process. Coverage appeared on TheHackerWire and was noted in the CISA weekly vulnerability bulletin for the week of January 5, 2026 (TheHackerWire, CISA Bulletin).