CVE-2026-24412: 
Homebrew vulnerability analysis and mitigation

CVE-2026-24412 is a heap-based buffer overflow vulnerability in the iccDEV library, specifically in the icCurvesFromXml() function (located at IccXML/IccLibXML/IccTagXml.cpp:3294), triggered when processing malformed ICC color profile XML data. It affects iccDEV versions 2.3.1.1 and below, maintained by the International Color Consortium. The vulnerability was disclosed on January 23–24, 2026, with a fix released in version 2.3.1.2. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) leading to a heap-based buffer overflow (CWE-122) in the icCurvesFromXml() function. Specifically, the icMBBFromXml() function incorrectly passed a negated condition (!pMBB->IsInputMatrix()) when determining the curve count for MCurves allocation, causing a mismatch between the allocated buffer size and the number of curves subsequently written — resulting in a one-element out-of-bounds write of 8 bytes on the heap. An attacker delivers a crafted ICC profile XML file (e.g., via a web upload or email attachment) that, when processed by the iccFromXml tool or any application using the iccDEV library, triggers the overflow. The fix in commit 2be3b12 corrects the boolean logic to pMBB->IsInputMatrix() ? nIn : nOut, aligning allocation with usage (GitHub Issue #518, GitHub Commit).

Successful exploitation can result in arbitrary code execution, denial of service, data manipulation, and bypass of application logic that relies on ICC profile metadata. All three security dimensions — confidentiality, integrity, and availability — are rated HIGH, meaning an attacker could fully compromise the affected process, corrupt or exfiltrate data, or crash the application. Because iccDEV is a library used in image-processing pipelines, downstream applications that embed it (e.g., color management tools, image editors) are also at risk if they process untrusted ICC profiles (GitHub Advisory, Feedly).

A proof-of-concept (PoC) exploit file (heap-buffer-overflow-icCurvesFromXml-IccTagXml_cpp-Line3294.xml) is publicly available via the researcher's GitHub repository and was referenced in the original issue report. Exploitation requires user interaction — a user or automated process must open or parse the malicious ICC profile — but requires no authentication or special privileges. The EPSS score is approximately 0.062%, indicating low current exploitation probability. There is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Issue #518, Feedly).

1. Craft or obtain a malicious ICC profile XML: Use the publicly available PoC file (heap-buffer-overflow-icCurvesFromXml-IccTagXml_cpp-Line3294.xml) from the researcher's Commodity-Injection-Signatures repository, or craft a custom XML ICC profile with manipulated MCurves tag data that causes a mismatch between allocated curve count and parsed curve count.
2. Deliver the malicious file: Distribute the crafted XML ICC profile to a target user via email attachment, web upload form, or any channel where the target application processes ICC profiles from untrusted sources.
3. Trigger parsing: Induce the target to open or process the file using iccFromXml or any application embedding the vulnerable iccDEV library (versions ≤ 2.3.1.1), which invokes CIccProfileXml::LoadXml() → ParseXml() → ParseTag() → icMBBFromXml() → icCurvesFromXml().
4. Trigger heap overflow: The incorrect boolean logic in icMBBFromXml() causes icCurvesFromXml() to write beyond the allocated heap buffer (8-byte out-of-bounds WRITE at IccTagXml.cpp:3294), corrupting adjacent heap memory.
5. Achieve objective: Depending on heap layout and attacker control, the overflow may crash the process (DoS), corrupt data structures to bypass application logic, or — with further exploitation primitives — achieve arbitrary code execution in the context of the vulnerable process (GitHub Issue #518, GitHub Advisory).

• File System: Presence of unexpected .xml ICC profile files with MCurves tags containing anomalous curve count values; PoC filename pattern heap-buffer-overflow-icCurvesFromXml-IccTagXml_cpp-Line3294.xml or similar.
• Process: Crashes or abnormal termination of iccFromXml or any application embedding iccDEV when processing ICC profile files; AddressSanitizer output referencing icCurvesFromXml at IccTagXml.cpp:3294 if instrumented builds are in use.
• Logs: Application crash logs or core dumps originating from CIccProfileXml::LoadXml(), icMBBFromXml(), or icCurvesFromXml() call stacks; error messages such as Error! - Failed to parse MCurves. in application output.
• Network: Unusual inbound delivery of .xml or .icc files to services that process ICC profiles; downloads from the researcher's PoC repository (github.com/xsscx/Commodity-Injection-Signatures) on endpoints running iccDEV (GitHub Issue #518).

Upgrade iccDEV to version 2.3.1.2 or later, which corrects the boolean logic error in icMBBFromXml() (commit 2be3b12). No official workarounds are provided by the vendor. As interim mitigations, restrict the ability of users and automated processes to open or process ICC profiles from untrusted sources, apply network-level controls to filter malicious ICC profile delivery, and consider disabling ICC color management functionality if not essential. Organizations using downstream applications that embed iccDEV should verify whether those applications have incorporated the patched library version (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researcher xsscx and credited to ChrisCoxArt as the remediation developer in the GitHub security advisory. Coverage appeared on The Hacker Wire and Infinit Security shortly after disclosure, and the CVE was referenced in a CISA vulnerability bulletin (SB26-026) for the week of January 19, 2026. Social media mentions were observed on Mastodon and Bluesky, indicating moderate community awareness (GitHub Advisory, CISA Bulletin).