CVE-2026-25582: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25582 is a heap buffer overflow (read) vulnerability in the iccDEV library's CIccIO::WriteUInt16Float() function, triggered when converting malformed XML to ICC profiles via the iccFromXml command-line tool. It affects all iccDEV versions prior to 2.3.1.3, developed by the International Color Consortium. The vulnerability was reported on January 31, 2026, publicly disclosed on February 4, 2026, and patched in version 2.3.1.3 released shortly after. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper bounds validation in CIccIO::WriteUInt16Float() (IccIO.cpp:298), classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-122 (Heap-based Buffer Overflow), and CWE-787 (Out-of-bounds Write). When the iccFromXml tool processes a malformed XML file containing a 16-bit LUT tag (CIccTagLut16) with mismatched curve sizes, the code calls WriteUInt16Float() with a buffer length that exceeds the actual allocated heap region — reading 4 bytes past the end of a 1020-byte allocation. The fix, introduced in PR #561, adds explicit size validation to ensure that each curve's size matches the expected nInputEntries and nOutputEntries before writing, preventing the out-of-bounds access (GitHub Issue, GitHub Commit).

Successful exploitation can result in unauthorized memory reads, potential memory corruption, denial of service via process crash, and — in contexts where vulnerable native libraries process the malformed profile downstream — potentially arbitrary code execution. The vulnerability affects confidentiality, integrity, and availability at a high level, as heap memory adjacent to the overflowed buffer may contain sensitive data or control structures. Applications and pipelines that rely on iccDEV to process user-supplied ICC profile XML are at risk of data disclosure or corruption (GitHub Advisory, GitHub Issue).

A proof-of-concept (PoC) XML file triggering the overflow is publicly available on GitHub, hosted by the original reporter (xsscx) at https://raw.githubusercontent.com/xsscx/fuzz/refs/heads/master/xml/icc/heap-buffer-overflow-CIccIO-WriteUInt16Float-IccIO_cpp-Line298.xml. Exploitation requires local access and user interaction (i.e., a user or automated process must invoke iccFromXml with the malicious file), limiting the attack surface. There is no evidence of in-the-wild exploitation at this time, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (very low probability of exploitation in the near term) (GitHub Issue, Feedly).

1. Prepare the malicious XML file: Obtain or craft a malformed ICC profile XML file containing a lut16 tag with curve data whose size does not match the declared nInputEntries or nOutputEntries fields. The public PoC file (heap-buffer-overflow-CIccIO-WriteUInt16Float-IccIO_cpp-Line298.xml) from the reporter's repository can be used directly.
2. Deliver the file to the target: Place the malicious XML file in a location accessible to the target user or automated pipeline that invokes iccFromXml (e.g., a shared directory, email attachment, or upload endpoint).
3. Trigger processing: Cause the target to execute iccFromXml <malicious.xml> output.icc. This can occur through direct user action or by exploiting an automated ICC profile conversion workflow.
4. Heap buffer overflow triggered: During XML parsing, CIccTagXmlLut16::ParseXml() allocates a curve buffer via CIccTagCurve::SetSize() with a size mismatched to the LUT's declared entry count. When CIccTagLut16::Write() calls CIccIO::WriteUInt16Float() with the declared entry count, it reads 4 bytes past the end of the allocated heap region.
5. Achieve objective: Depending on heap layout and memory contents, the attacker may read adjacent heap data (information disclosure), cause a process crash (denial of service), or — in a more controlled environment — leverage the out-of-bounds write primitive for further exploitation (GitHub Issue, GitHub Advisory).

• Process: Unexpected crash or abort of iccFromXml process; AddressSanitizer output referencing CIccIO::WriteUInt16Float at IccProfLib/IccIO.cpp:298 or CIccTagLut16::Write at IccProfLib/IccTagLut.cpp:5231.
• Logs: System crash logs or core dumps associated with the iccFromXml binary; error messages containing heap-buffer-overflow or ABORTING from ASan-instrumented builds.
• File System: Presence of unexpected or unusually structured XML files with .xml extensions in directories used by ICC profile conversion workflows; output ICC files with non-compliant or malformed profile headers (e.g., unknown platform signatures like HOYT).
• Network: Unexpected downloads of XML files from external sources to systems running iccDEV tools, particularly from raw GitHub content URLs or unknown origins (GitHub Issue).

The primary remediation is to upgrade iccDEV to version 2.3.1.3 or later, which includes the fix from PR #561 (commit b5e5dd2) that validates 16-bit LUT curve sizes before writing (GitHub Commit, GitHub Advisory). No official workarounds are provided by the maintainers. Until patching is complete, restrict access to the iccFromXml tool, avoid processing XML files from untrusted sources, and implement input validation for any ICC profile XML ingestion pipelines.