CVE-2026-24406: 
Homebrew vulnerability analysis and mitigation

CVE-2026-24406 is a heap-based buffer overflow vulnerability in the CIccTagNamedColor2::SetSize() function of iccDEV, a library and toolset for interacting with ICC color management profiles maintained by the International Color Consortium. The vulnerability affects iccDEV versions 2.3.1.1 and below, and was disclosed on January 24, 2026. It carries a CVSS v3.1 base score of 8.8 (High), requiring no privileges but necessitating user interaction (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) leading to a heap-based buffer overflow (CWE-122) in IccProfLib/IccTagBasic.cpp at line 2850. Specifically, the CIccTagXmlNamedColor2::ParseXml() function incorrectly assigned the device coordinate count to m_nDeviceCoords before calling SetSize(), and used the wrong loop index variable (i instead of j) when copying device coordinate values — causing out-of-bounds reads beyond the allocated heap region. An attacker can trigger this by supplying a crafted XML-based ICC profile file processed by the iccFromXml tool or any application using the iccDEV library. The AddressSanitizer trace confirms a READ of 4 bytes at 0 bytes past the end of a 48-byte heap allocation (GitHub Issue #480, Patch Commit).

Successful exploitation can result in denial of service (application crash), data manipulation, bypass of application logic relying on ICC profile metadata, and potentially arbitrary code execution in contexts where vulnerable native libraries process the malformed profile. The vulnerability has high impact on confidentiality, integrity, and availability, as confirmed by the CVSS scoring. Downstream image-processing libraries or applications that embed iccDEV for color profile handling are also at risk of memory corruption (GitHub Advisory).

A proof-of-concept exploit is publicly available as a crafted XML ICC profile file hosted in the xsscx Commodity-Injection-Signatures repository, referenced in the original GitHub issue report. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.062%, indicating a low but non-zero probability of exploitation in the near term (GitHub Issue #480, Feedly).

1. Obtain the PoC payload: Download the crafted XML ICC profile from the public Commodity-Injection-Signatures repository: wget https://raw.githubusercontent.com/xsscx/Commodity-Injection-Signatures/refs/heads/master/xml/icc/heap-buffer-overflow-CIccTagNamedColor2-CIccTagNamedColor2-IccProfLib-IccTagBasic_cpp-Line2850.xml
2. Identify a vulnerable target: Locate a system running iccDEV version 2.3.1.1 or earlier, or an application that uses the iccDEV library to process ICC profiles (e.g., image editors, color management tools).
3. Deliver the malicious ICC profile: Trick a user into opening or processing the crafted XML ICC profile file — for example, by embedding it in a document, image, or sending it via email/web download.
4. Trigger the overflow: When the target application calls iccFromXml or invokes CIccTagXmlNamedColor2::ParseXml() on the malicious file, the incorrect device coordinate count and wrong loop index cause a heap buffer overflow at IccTagBasic.cpp:2850.
5. Achieve impact: Depending on heap layout and memory protections, the overflow may crash the application (DoS), corrupt adjacent heap data, or in favorable conditions enable arbitrary code execution in the context of the processing application (GitHub Issue #480, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .xml or .icc files with unusual NamedColor tag structures containing mismatched device coordinate counts; crafted ICC profile files with malformed tag tables or oversized size fields.
• Process: Application crashes or abnormal termination of processes using iccDEV (e.g., iccFromXml, image editors with ICC support); AddressSanitizer or similar runtime error output referencing CIccTagNamedColor2::SetSize() at IccTagBasic.cpp:2850.
• Logs: Crash reports or core dumps from ICC profile processing applications; error logs referencing heap corruption or out-of-bounds memory access in color management components.
• Network: Unexpected downloads of .xml or .icc files from external or untrusted sources to systems running iccDEV-based applications (GitHub Issue #480).

Upgrade iccDEV to version 2.3.1.2 or later, which fixes both the incorrect assignment order for the named color device coordinate count and the wrong loop index variable in IccTagXml.cpp. No official workarounds are provided by the vendor. As interim measures, restrict ICC profile processing to validated, trusted files only, and avoid processing ICC profiles from untrusted or external sources until patching is complete (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher xsscx on January 18, 2026, and remediated by ChrisCoxArt (maintainer) in the same month. The issue was triaged and labeled as a confirmed security bug by the iccDEV maintainers. Coverage appeared on The Hacker Wire and was noted in the CISA weekly vulnerability bulletin for the week of January 19, 2026 (CISA Bulletin, The Hacker Wire).