CVE-2026-24410: 
Homebrew vulnerability analysis and mitigation

CVE-2026-24410 is a null pointer dereference and undefined behavior vulnerability in the CIccProfileXml::ParseBasic() function of iccDEV, a library for interacting with ICC color management profiles maintained by the International Color Consortium. It affects iccDEV versions 2.3.1.1 and below, and was disclosed on January 23–24, 2026. The vulnerability arises when user-controllable input is unsafely incorporated into ICC profile data, specifically when parsing the RenderingIntent XML element without validating the pNode->children->content pointer. The CVSS v3.1 base score is 8.8 (High) per Feedly/NVD, while the GitHub Security Advisory scores it at 7.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper input validation (CWE-20) combined with a null pointer dereference (CWE-476) and unchecked return value leading to null pointer dereference (CWE-690), as well as reliance on undefined behavior (CWE-758). Specifically, in IccXML/IccLibXML/IccProfileXml.cpp at line 493, the code checks for pNode->children but fails to also verify that pNode->children->content is non-null before passing it to strcmp(). When a crafted XML-based ICC profile omits the content of the RenderingIntent element, a null pointer is passed to strcmp(), triggering a segmentation fault (SIGSEGV) and undefined behavior. The fix, committed in patch 3cf522b, adds the additional null check: if (!pNode->children || !pNode->children->content) (GitHub Issue #507, GitHub Commit).

Successful exploitation can result in denial of service (application crash via SIGSEGV), data manipulation through malformed ICC tag tables or offsets, bypass of application logic relying on profile metadata, and potentially arbitrary code execution in contexts where vulnerable native libraries process the malformed profile. Confidentiality impact is rated none to high depending on the scoring source, while integrity and availability are both rated as impacted. Applications that process user-supplied ICC profile files — such as image editors, color management tools, or document processors — are at risk (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available on GitHub (Issue #507), consisting of a crafted XML ICC profile file that triggers the null pointer dereference when processed by the iccFromXml tool. The attack vector is network-accessible with low complexity, requires no privileges, but does require user interaction (e.g., opening or processing a malicious ICC profile file). The EPSS score is approximately 0.055% (0.000550), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Issue #507, Feedly).

1. Craft malicious ICC profile: Create a malformed XML-based ICC profile file (.xml) that includes a RenderingIntent element with no text content (empty or missing child node content), which will result in pNode->children->content being null when parsed.
2. Obtain the PoC: Download the publicly available PoC file from the researcher's repository: wget https://raw.githubusercontent.com/xsscx/fuzz/refs/heads/master/xml/icc/npd-ub-runtime-error-null-pointer-IccProfileXml_cpp-L493.xml
3. Deliver the file: Distribute the malicious ICC profile to a target user via email attachment, web download, or embedding in a document — any vector that causes the target application to process the file using the vulnerable iccDEV library.
4. Trigger parsing: When the victim opens or processes the file with an application using iccDEV ≤ 2.3.1.1 (e.g., running iccFromXml malicious.xml output.icc), CIccProfileXml::ParseBasic() is called and passes a null pointer to strcmp() at line 493.
5. Achieve impact: The application crashes with a SIGSEGV (DoS), or in more complex exploitation scenarios involving memory layout manipulation, potentially achieves code execution in the context of the processing application (GitHub Issue #507, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .xml ICC profile files (especially with empty <RenderingIntent> elements) in directories processed by iccDEV-based applications.
• Process: Application crashes or abnormal termination of processes using iccDEV (e.g., iccFromXml) with exit signals indicating SIGSEGV; AddressSanitizer output referencing IccProfileXml.cpp:493 and strcmp in the stack trace.
• Logs: Application error logs showing runtime error: null pointer passed as argument 1, which is declared to never be null or AddressSanitizer: SEGV on unknown address 0x000000000000; crash reports referencing CIccProfileXml::ParseBasic() or CIccProfileXml::ParseXml().
• Network: Unusual downloads of .xml files with ICC profile structure from untrusted sources, particularly files with minimal or malformed RenderingIntent elements (GitHub Issue #507).

Upgrade iccDEV to version 2.3.1.2 or later, which includes the fix that adds a null check for pNode->children->content before passing it to strcmp() in CIccProfileXml::ParseBasic(). No official workarounds are provided by the vendor; however, as an interim measure, administrators should restrict the ability of users or automated processes to load untrusted ICC profile files until patching is complete. The patch is available at commit 3cf522b and the fixed release is documented in the GitHub Security Advisory (GitHub Commit, GitHub Advisory).

Red Hat has acknowledged the vulnerability and published a CVE tracking page, indicating potential downstream impact on Linux distributions that package iccDEV (Red Hat CVE). The CISA included the CVE in its weekly vulnerability bulletin for the week of January 19, 2026. The vulnerability was reported by researcher xsscx, who also provided the PoC and was credited in the GitHub Security Advisory alongside remediation developer ChrisCoxArt. Community coverage has been limited to automated vulnerability tracking services and security news aggregators.