CVE-2026-24852: 
Homebrew vulnerability analysis and mitigation

CVE-2026-24852 is a heap buffer over-read vulnerability in the icXmlParseTextString() function of the iccDEV library, maintained by the International Color Consortium. The flaw occurs when the strlen() function attempts to read a non-null-terminated buffer during ICC color profile parsing, potentially leaking heap memory contents and causing application termination. It affects all iccDEV versions prior to 2.3.1.2 and was disclosed on January 28, 2026. The CVSS v3.1 base score is 8.1 (High) per Feedly/NVD, while the GitHub Security Advisory rates it 6.1 (Moderate) using a local attack vector (GitHub Advisory, Red Hat CVE).

The root cause is improper null termination (CWE-170) in the icXmlParseTextString() function located in IccXML/IccLibXML/IccTagXml.cpp (around line 194), which leads to an out-of-bounds read (CWE-125) and heap-based buffer overflow condition (CWE-122). Specifically, when hex-encoded text data is read from an ICC XML profile, the buffer was not allocated with sufficient space for null terminators, causing strlen() to read beyond the allocated heap region. Exploitation requires a user to open or process a maliciously crafted ICC color profile file, making user interaction a prerequisite. The fix in PR #540 allocates two extra bytes for the hex string buffer and explicitly null-terminates it before use (GitHub Advisory, GitHub PR #540, Fix Commit).

Successful exploitation can result in two primary consequences: disclosure of sensitive heap memory contents (confidentiality impact) and application termination via crash (availability impact). Because ICC profiles are binary structures with tag tables, offsets, and size fields, a crafted profile could also trigger parsing errors or memory corruption in downstream image-processing libraries, potentially enabling denial of service or, in some contexts, arbitrary code execution. Integrity is not directly impacted, but the vulnerability could be used to bypass application logic relying on profile metadata (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a user must process a maliciously crafted ICC color profile — which limits the attack surface (Feedly).

1. Craft a malicious ICC XML profile: Create an ICC profile in XML format (.xml) containing a <HexTextData> element with hex-encoded content that, when decoded, produces a buffer without proper null termination.
2. Deliver the profile to the target: Distribute the malicious ICC profile via email attachment, web download, or embed it in an image file processed by an application using the iccDEV library (e.g., via iccFromXml).
3. Trigger parsing: Induce the victim user to open or process the crafted file with an application linked against a vulnerable version of iccDEV (< 2.3.1.2), causing icXmlParseTextString() to be invoked.
4. Heap over-read occurs: The strlen() call on the non-null-terminated buffer reads beyond the allocated heap region, leaking adjacent heap memory contents or causing an access violation.
5. Achieve objective: Depending on heap layout and application context, the attacker may obtain leaked heap data (e.g., pointers, credentials, keys) from application output or crash logs, or cause a denial of service via application termination (GitHub Advisory, GitHub PR #540).

• File System: Presence of unexpected or externally sourced .icc or .xml ICC profile files in directories processed by applications using iccDEV; files with malformed HexTextData elements in ICC XML profiles.
• Logs: Application crash logs or core dumps originating from processes linked against iccDEV, particularly stack traces referencing icXmlParseTextString() in IccTagXml.cpp; AddressSanitizer (ASan) reports indicating heap-buffer-overflow at IccLibXML/IccTagXml.cpp:194.
• Process: Unexpected termination of image-processing or color management applications; processes spawning with ICC profile file arguments from untrusted sources.
• Network: Unusual downloads of .icc or .xml files from external or unknown sources to systems running iccDEV-linked applications (GitHub Advisory).

Upgrade iccDEV to version 2.3.1.2 or later, which contains the fix introduced in PR #540 (commit 3092499). The patch adds proper null termination to hex-decoded buffers in icXmlParseTextString() and introduces a isLegalUTF8String() validation function. No workarounds are available for users unable to patch immediately; as a compensating control, restrict processing of ICC color profiles from untrusted or external sources. Monitor applications using iccDEV for unexpected crashes that may indicate exploitation attempts (GitHub Advisory, Fix Commit).

The vulnerability was credited to researcher ChrisCoxArt (discovery) and xsscx (remediation verification) within the iccDEV project. The fix was reviewed and merged by the maintainer (xsscx) on January 27, 2026, the same day it was reported, reflecting a rapid response from the project team. Red Hat has acknowledged the CVE in their security tracking system. No significant broader media coverage or notable community commentary beyond the GitHub advisory and standard vulnerability database entries has been observed (GitHub Advisory, Red Hat CVE).