CVE-2026-24409: 
Homebrew vulnerability analysis and mitigation

CVE-2026-24409 is a null pointer dereference and undefined behavior vulnerability in the iccDEV library's CIccTagXmlFloatNum<>::ParseXml() function, affecting versions 2.3.1.1 and below. The flaw allows network-accessible attackers to cause denial of service, manipulate data, bypass application logic, or potentially achieve code execution by supplying malicious ICC color profile data. It was reported on January 19, 2026, and publicly disclosed on January 23–24, 2026, with a fix released in version 2.3.1.2. The CVSS v3.1 base score is 8.8 (High) per NVD, while the GitHub Security Advisory rates it 7.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper input validation (CWE-20) combined with a null pointer dereference (CWE-476) and unchecked return value leading to null pointer dereference (CWE-690), as well as reliance on undefined behavior (CWE-758). Specifically, in IccXML/IccLibXML/IccTagXml.cpp at line 1578, the code dereferences pNode->children without first verifying that pNode is non-null, which can be triggered when user-controllable input is incorporated into ICC profile XML data. An attacker crafts a malicious XML-based ICC profile file (e.g., using the publicly available PoC payload ub-member-access-null-pointer-struct-xmlnode.xml) and causes the vulnerable application to parse it via iccFromXml, triggering a SEGV/DEADLYSIGNAL. The fix, committed as 9f134c4, adds a null check (if (!pNode) return false;) before the dereference (GitHub Issue, GitHub Commit).

Successful exploitation can result in denial of service via application crash (SEGV), data manipulation through corrupted ICC tag tables or offsets, bypass of application logic relying on profile metadata, and potentially arbitrary code execution in contexts where vulnerable native libraries process the malformed profile. The vulnerability affects confidentiality (High per NVD), integrity (High), and availability (High), though the GitHub Advisory rates confidentiality impact as None and integrity as Low. Applications and image-processing pipelines that consume untrusted ICC color profiles are at greatest risk (GitHub Advisory).

A proof-of-concept exploit (a crafted XML ICC profile file) is publicly available on GitHub and was used to demonstrate the vulnerability during initial disclosure. Exploitation requires user interaction — a user or automated process must open or parse the malicious ICC profile — but requires no authentication or special privileges. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been made. The EPSS score is approximately 0.055% (0.000550), indicating low current exploitation probability. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Issue, GitHub Advisory).

1. Obtain the PoC payload: Download the publicly available malicious XML ICC profile from the reporter's repository: wget https://raw.githubusercontent.com/xsscx/Commodity-Injection-Signatures/refs/heads/master/xml/icc/ub-member-access-null-pointer-struct-xmlnode.xml
2. Identify a vulnerable target: Locate a system or application running iccDEV version 2.3.1.1 or earlier that processes user-supplied ICC color profiles (e.g., image editors, color management tools, or web services accepting image uploads).
3. Deliver the malicious profile: Supply the crafted XML ICC profile to the target application — either directly via the iccFromXml command-line tool, or by embedding it in an image file accepted by a downstream application.
4. Trigger parsing: The application invokes CIccProfileXml::LoadXml() → ParseXml() → ParseTag() → CIccTagXmlFloatNum<>::ParseXml(), reaching line 1578 of IccTagXml.cpp where pNode is null.
5. Achieve impact: The null pointer dereference triggers a SEGV (crash/DoS). In contexts with exploitable memory layouts or additional vulnerabilities, this undefined behavior may be leveraged for code execution (GitHub Issue, GitHub Advisory).

• Process: Application crash (SEGV/DEADLYSIGNAL) in processes loading ICC profiles; AddressSanitizer output referencing CIccTagXmlFloatNum<>::ParseXml() in libIccXML2.so; unexpected termination of image-processing services.
• Logs: Error messages containing runtime error: member access within null pointer of type 'struct xmlNode' at IccLibXML/IccTagXml.cpp:1578; AddressSanitizer reports referencing libIccXML2.so and IccFromXml.
• File System: Presence of unexpected or externally sourced .xml or .icc files in directories processed by iccDEV-based tools; files matching the pattern ub-member-access-null-pointer-struct-xmlnode.xml or similar fuzzer-generated names.
• Network: Unusual uploads of .icc or XML-formatted ICC profile files to web services; repeated requests delivering malformed ICC profile data to image-processing endpoints (GitHub Issue).

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix (commit 9f134c4) that adds a null pointer check before dereferencing pNode in CIccTagXmlFloatNum<>::ParseXml(). No official workarounds are provided by the vendor. As interim mitigations, restrict user interaction with untrusted ICC color profile files, limit network access to systems processing ICC profiles, and implement input validation or allowlisting for ICC profile data before it reaches the library (GitHub Advisory, GitHub Commit).

The vulnerability was reported by security researcher xsscx and remediated by ChrisCoxArt (maintainer). The issue was triaged and labeled as a confirmed security bug by the iccDEV maintainers. Red Hat tracked the CVE and CISA included it in a weekly vulnerability bulletin (SB26-026) for the week of January 19, 2026. Community coverage was limited to automated vulnerability feeds and aggregators (Red Hat CVE, CISA Bulletin).