CVE-2026-24404: 
Homebrew vulnerability analysis and mitigation

CVE-2026-24404 is a Null Pointer Dereference and Undefined Behavior vulnerability in the CIccXmlArrayType() function of iccDEV, a library and toolset for interacting with ICC color management profiles maintained by the International Color Consortium. It affects iccDEV versions 2.3.1.1 and below, and was disclosed on January 24, 2026, with a patch released in version 2.3.1.2 (GitHub Advisory). The vulnerability carries a CVSS v3.1 base score of 8.8 (High) per Feedly/NVD, though the official GitHub advisory scores it at 7.1 (High) using a more conservative vector (GitHub Advisory, Red Hat CVE).

The root cause is improper input validation (CWE-20) in the CIccXmlArrayType::ParseArray() function within IccXML/IccLibXML/IccUtilXml.cpp, where the pNode pointer is dereferenced without first checking for NULL (CWE-476, CWE-690). Additionally, the code relies on undefined behavior when loading invalid enum values for type icSigCalcOp in IccProfLib/IccMpeCalc.cpp (CWE-758). The fix, committed as cd637eb, adds a NULL check for pNode before dereferencing it (Patch Commit). Exploitation requires a user to process a maliciously crafted ICC profile file, which can be delivered over the network; a proof-of-concept ICC file triggering the UB runtime error has been publicly documented (GitHub Issue #488).

Successful exploitation can result in denial of service (application crash), data manipulation, bypass of application logic that relies on ICC profile metadata, and potentially arbitrary code execution when vulnerable native libraries process a malformed ICC profile (GitHub Advisory). The vulnerability can affect downstream image-processing libraries and applications that depend on iccDEV for ICC profile parsing, broadening the potential attack surface beyond the library itself. Confidentiality impact is assessed as none to high depending on the scoring source, while integrity and availability impacts are rated high (Feedly).

A proof-of-concept ICC profile file that triggers the undefined behavior runtime error is publicly available via the iccDEV GitHub issue tracker (GitHub Issue #488). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.055% (0.000550), indicating a low probability of exploitation in the near term (Feedly). No threat actor attribution has been reported.

1. Craft a malicious ICC profile: Create or obtain a specially crafted ICC profile binary (.icc file) that contains invalid or malformed tag data — specifically, values that cause CIccXmlArrayType::ParseArray() to receive a NULL pNode, or that embed invalid icSigCalcOp enum values (e.g., 3630459254) in the IccMpeCalc processing path. A sample PoC file is publicly available at the Commodity Injection Signatures repository referenced in GitHub Issue #488.
2. Deliver the malicious profile: Host the crafted .icc file on an attacker-controlled server or embed it in a document/image. Deliver it to a target user via phishing, a malicious website, or any channel that causes the victim to open or process the file with an application using iccDEV ≤ 2.3.1.1.
3. Trigger parsing: The victim opens the file or the application automatically processes the ICC profile (e.g., via image color management). The vulnerable iccFromXml or iccDumpProfile tool — or any application linking iccDEV — parses the malformed profile.
4. Trigger NULL dereference / UB: The parser reaches CIccXmlArrayType::ParseArray() with a NULL pNode, causing a null pointer dereference, or reaches IccMpeCalc.cpp with an invalid enum value, triggering undefined behavior. This results in a crash (DoS) or, in exploitable memory layouts, potential code execution.

• File System: Presence of unexpected or externally sourced .icc profile files in user download directories, temp folders, or application data paths; files matching known PoC hashes from the Commodity Injection Signatures repository.
• Process: Crashes or abnormal termination of applications that process ICC profiles (e.g., image editors, color management tools, print spoolers) with signals such as SIGSEGV or SIGABRT; UBSan/ASan runtime error messages referencing IccProfLib/IccMpeCalc.cpp:1834 or IccXML/IccLibXML/IccUtilXml.cpp.
• Logs: Application crash logs or core dumps referencing CIccXmlArrayType::ParseArray, IccMpeCalc.cpp, or runtime errors such as load of value 3630459254, which is not a valid value for type 'icSigCalcOp' (GitHub Issue #488).
• Network: Unexpected downloads of .icc files from external or untrusted sources; HTTP requests fetching ICC profiles from domains not associated with legitimate color management workflows.

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix adding a NULL check for pNode before dereferencing in CIccXmlArrayType::ParseArray() (Patch Commit, GitHub Advisory). No official workarounds are provided by the vendor; however, organizations should restrict processing of ICC profile files from untrusted sources and consider disabling ICC profile handling functionality until patching is complete. Network-level controls to block delivery of malicious ICC profiles and monitoring for unexpected application crashes are recommended interim measures (Feedly).

Red Hat has acknowledged the vulnerability and published a CVE tracking page (Red Hat CVE). The vulnerability was noted in a CISA weekly vulnerability bulletin for the week of January 19, 2026, and covered by security aggregators including INCIBE-CERT and VulnDB. Community discussion has been limited, with the primary technical disclosure occurring via the iccDEV GitHub security advisory and issue tracker. No significant social media controversy or major vendor statements beyond the patch release have been observed.