CVE-2026-24411: 
Homebrew vulnerability analysis and mitigation

CVE-2026-24411 is an undefined behavior vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function of the iccDEV library, which provides tools for interacting with and applying ICC color management profiles. It affects iccDEV versions 2.3.1.1 and below, where user-controllable input is unsafely incorporated into ICC profile data via an invalid C++ downcast (type punning), leading to undefined behavior, NULL pointer dereference, and potential code execution. The vulnerability was reported on January 20, 2026, and publicly disclosed on January 23–24, 2026, with a fix released in version 2.3.1.2. It carries a CVSS v3.1 base score of 8.8 (High) per Feedly/NVD, though the GitHub Security Advisory scores it at 7.1 (High) with a different vector emphasizing availability impact over confidentiality (GitHub Advisory, Feedly).

The root cause is an unsafe C++ downcast (type punning) at IccXML/IccLibXML/IccTagXml.cpp:3094, where the code incorrectly casts a CIccSegmentedCurve object pointer to CIccSegmentedCurveXml* using a C-style cast rather than properly constructing the XML subclass — a classic violation of C++ object model rules classified under CWE-758 (Reliance on Undefined Behavior), CWE-476 (NULL Pointer Dereference), CWE-690 (Unchecked Return Value to NULL Pointer Dereference), and CWE-20 (Improper Input Validation). An attacker crafts a malicious ICC profile file that, when processed by the iccToXml tool or any application using the iccDEV library, triggers the invalid downcast at line 3094, causing undefined behavior at runtime. The fix in commit d6d6f51 replaces the unsafe cast ((CIccSegmentedCurveXml*)m_pCurve)->ToXml(...) with a proper object construction CIccSegmentedCurveXml(m_pCurve).ToXml(...). A proof-of-concept ICC file and reproduction steps are publicly available in the GitHub issue tracker (GitHub Issue #499, Patch Commit).

Successful exploitation can result in denial of service (application crash), data manipulation (tampering with ICC tag tables, offsets, or size fields), bypass of application logic relying on profile metadata, and in some contexts arbitrary code execution when vulnerable native libraries process the malformed profile. The vulnerability affects any application or pipeline that uses iccDEV to process ICC color profiles, including image-processing tools and color management workflows. Confidentiality, integrity, and availability are all potentially impacted, though the primary risk per the GitHub advisory is high availability impact and low integrity impact (GitHub Advisory, Feedly).

A proof-of-concept ICC file (undefined-behavior-type-confusion-runtime-error-CIccSegmentedCurveXmlIccLibXML-IccTagXml_cpp-Line3094.icc) is publicly available in the xsscx Commodity Injection Signatures repository on GitHub, with detailed reproduction steps published in the iccDEV issue tracker. Exploitation requires user interaction — a user or automated pipeline must open or process the malicious ICC profile — but requires no authentication or special privileges. The EPSS score is approximately 0.064% (low probability of near-term exploitation), and there is no current listing in the CISA Known Exploited Vulnerabilities (KEV) catalog. Feedly notes exploitation has been reported by various sources, though no specific threat actor attribution is available (GitHub Issue #499, Feedly).

1. Obtain the PoC ICC file: Download the publicly available malicious ICC profile from the xsscx Commodity Injection Signatures repository: wget https://github.com/xsscx/Commodity-Injection-Signatures/raw/refs/heads/master/graphics/icc/undefined-behavior-type-confusion-runtime-error-CIccSegmentedCurveXmlIccLibXML-IccTagXml_cpp-Line3094.icc
2. Identify a target: Locate a system or application using iccDEV version 2.3.1.1 or earlier that processes ICC profiles (e.g., the iccToXml command-line tool or any downstream image-processing application embedding the library).
3. Deliver the malicious ICC profile: Provide the crafted ICC file to the target — via file upload, email attachment, embedded in an image, or any other vector that causes the application to process the profile.
4. Trigger the vulnerable code path: When the application calls CIccTagXmlSegmentedCurve::ToXml() on the malformed profile, the invalid C-style downcast at IccTagXml.cpp:3094 executes, causing undefined behavior (type confusion between CIccSegmentedCurve and CIccSegmentedCurveXml).
5. Achieve impact: Depending on the runtime environment and memory layout, the undefined behavior may result in a crash (DoS), memory corruption, data manipulation, or arbitrary code execution within the context of the processing application (GitHub Issue #499, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .icc profile files in application input directories or temporary folders; ICC files with malformed tag tables or unusual segmented curve structures.
• Logs: Application crash logs or core dumps referencing IccXML/IccLibXML/IccTagXml.cpp:3094; UBSan (Undefined Behavior Sanitizer) runtime error messages such as runtime error: downcast of address ... which does not point to an object of type 'CIccSegmentedCurveXml'; error messages referencing vptr for 'CIccSegmentedCurve'.
• Process: Unexpected termination or crash of iccToXml or any application embedding the iccDEV library after processing an ICC file; abnormal child process spawning from image-processing services.
• Network: Unusual downloads of .icc files from external or untrusted sources to systems running iccDEV-dependent applications (GitHub Issue #499, GitHub Advisory).

The primary remediation is to upgrade iccDEV to version 2.3.1.2 or later, which fixes the unsafe downcast by properly constructing a CIccSegmentedCurveXml object instead of type-punning the pointer. No workarounds are provided by the vendor. As interim mitigations, organizations should prevent users and automated pipelines from processing untrusted or unknown ICC profile files, and consider disabling ICC profile processing features if not critical to operations. The fix is available in commit d6d6f51 on the official repository (Patch Commit, GitHub Advisory).

The vulnerability was reported by security researcher xsscx and remediated by ChrisCoxArt (maintainer), with the issue triaged and labeled as a confirmed security bug. Red Hat has tracked the CVE in their security advisory database. The CISA weekly vulnerability bulletin for the week of January 19, 2026 included this CVE. Community discussion has been limited, with automated CVE tracking services (Vulners, VulDB, CIRCL) picking up the disclosure shortly after publication (Red Hat Advisory, GitHub Advisory).