CVE-2026-22861: 
Homebrew vulnerability analysis and mitigation

CVE-2026-22861 is a heap-based buffer overflow vulnerability in the iccDEV library's SIccCalcOp::Describe() function, located at IccProfLib/IccMpeCalc.cpp (line 1816). It affects all iccDEV versions prior to 2.3.1.2 and was discovered and disclosed on January 13, 2026. The vulnerability was reported by security researcher xsscx and fixed by ChrisCoxArt. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is an incorrect operation count calculation in CIccCalculatorFunc::DescribeSequence() when handling if-else branching logic in ICC Multi-Process Element (MPE) calculator functions. Specifically, the nSubOps variable was computed using nOps-i instead of nOps-i-2 (for the if-branch) and nOps-i instead of nOps-i-1 (for the else-branch), causing the function to read beyond the allocated heap buffer. The vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), CWE-130 (Improper Handling of Length Parameter Inconsistency), CWE-252 (Unchecked Return Value), and CWE-787 (Out-of-bounds Write). Exploitation requires a user to process a specially crafted ICC color profile file, triggering the overflow when the profile is parsed and described (GitHub Issue #475, Fix Commit).

Successful exploitation can result in remote code execution, data corruption, or application crashes, with high impact to confidentiality, integrity, and availability. An attacker who tricks a user into processing a malicious ICC color profile can potentially gain code execution in the context of the application using the iccDEV library. The attack requires no authentication or special privileges, only user interaction (e.g., opening or converting a malicious .icc file), and is deliverable over the network (GitHub Advisory, Feedly).

No public proof-of-concept exploit code exists beyond the reproducer ICC file (SIccCalcOpDescribe_.IccMpeCalc.cpp-L1790.icc) shared in the GitHub issue report, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Issue #475, Feedly).

1. Craft a malicious ICC profile: Create or obtain a specially crafted ICC color profile file that contains a Multi-Process Element (MPE) calculator tag with a malformed if-else operation sequence designed to trigger an out-of-bounds read in SIccCalcOp::Describe(). A public reproducer file (SIccCalcOpDescribe_.IccMpeCalc.cpp-L1790.icc) was shared in the GitHub issue report.
2. Deliver the malicious file: Distribute the crafted .icc file to a target user via email attachment, web download, or embedding it in a document or image that triggers color profile processing.
3. Trigger profile processing: Induce the victim to open or process the file using an application that relies on the vulnerable iccDEV library (e.g., using the iccToXml tool or any application that calls CIccProfileXml::ToXml()).
4. Trigger the overflow: When the application parses the ICC profile and calls CIccCalculatorFunc::DescribeSequence(), the incorrect nSubOps calculation causes a heap buffer over-read at IccMpeCalc.cpp:1816, potentially leading to memory corruption and code execution (GitHub Issue #475, Fix Commit).

• File System: Presence of unexpected or externally sourced .icc color profile files, particularly those with MPE calculator tags; files matching the known reproducer name SIccCalcOpDescribe_.IccMpeCalc.cpp-L1790.icc.
• Process: Application crashes or abnormal termination of processes using the iccDEV library (e.g., iccToXml) when processing ICC files; AddressSanitizer reports referencing IccProfLib/IccMpeCalc.cpp:1816 in debug builds.
• Logs: Application error logs showing heap corruption errors or segmentation faults originating from SIccCalcOp::Describe(), CIccCalculatorFunc::DescribeSequence(), or CIccMpeXmlCalculator::ToXml(); crash dumps referencing the iccDEV library stack trace (GitHub Issue #475).

Upgrade the iccDEV library to version 2.3.1.2 or later, which includes the fix merged via pull request #476 (commit fa9a364). The fix corrects the nSubOps calculation in CIccCalculatorFunc::DescribeSequence() for both if and else branches. No official workaround is provided; until patching is possible, avoid processing ICC color profiles from untrusted or unknown sources, and consider sandboxing applications that handle external color profiles (GitHub Advisory, Fix Commit).

The vulnerability received brief coverage from security news aggregators and social media accounts including TheHackerWire on Mastodon, Bluesky, and Infosec.Exchange shortly after disclosure. Coverage was largely informational, noting the heap overflow and the availability of a patch. No significant vendor statements beyond the GitHub advisory or notable researcher commentary beyond the original reporter (xsscx) and fix author (ChrisCoxArt) have been identified (Feedly).