CVE-2026-25584: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25584 is a stack-based buffer overflow vulnerability in the iccDEV library's CIccTagFloatNum<>::GetValues() function, triggered when processing a malformed ICC color management profile. It affects all iccDEV versions prior to 2.3.1.3 and was reported on January 29, 2026, with the fix merged on February 2, 2026, and the advisory published on February 4, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat).

The root cause is an out-of-bounds write on the stack (CWE-121, CWE-787) within CIccTagFloatNum<>::GetValues() at IccProfLib/IccTagBasic.cpp:6634, where the function used the size of the internal array rather than the caller-supplied size limit when iterating over values. This allowed a write beyond the stack buffer boundary when processing a specially crafted ICC profile with mismatched tag size fields. The fix, applied in PR #565 (commit c9cb108), corrects the loop to use the passed-in nVectorSize limit and also ensures profile data is read before the profile pointer is freed in IccCmm.cpp. A public proof-of-concept ICC file and reproduction steps are available in the original issue report (GitHub Issue #551, GitHub PR #565).

Successful exploitation can result in stack memory corruption, information disclosure of sensitive stack data, or arbitrary code execution in the context of the application processing the malicious ICC file. The attack is local and requires user interaction (e.g., opening or processing a crafted .icc file), limiting its scope, but applications that automatically process ICC profiles — such as image editors, color management tools, or document processors — may be exposed with minimal user awareness. Confidentiality, integrity, and availability are all rated High (GitHub Advisory).

A public proof-of-concept exploit file (stack-smashing-CIccTagFloatNum-CIccTagStruct-GetElemNumberValue-IccTagBasic_cpp-Line6634.icc) is available on GitHub and was used to reproduce the vulnerability during disclosure. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term (GitHub Issue #551, Feedly).

1. Craft or obtain a malicious ICC file: Use the publicly available PoC file (stack-smashing-CIccTagFloatNum-CIccTagStruct-GetElemNumberValue-IccTagBasic_cpp-Line6634.icc) from the researcher's GitHub repository, or craft a malformed ICC profile with manipulated tag size fields that cause GetValues() to write beyond the allocated stack buffer.
2. Deliver the file to the target: Social-engineer the victim into opening the malicious ICC file with an application that uses the vulnerable iccDEV library (e.g., via email attachment, download link, or embedded in a document).
3. Trigger processing: The victim opens or the application automatically processes the ICC file, invoking CIccTagFloatNum<>::GetValues() at IccTagBasic.cpp:6634 via the call chain: iccApplyNamedCmm → CIccNamedColorCmm::AddXform() → CIccXform::Create() → icConvertEncodingProfile() → CIccTagStruct::GetElemNumberValue() → CIccTagFloatNum::GetValues().
4. Stack buffer overflow occurs: The function writes a 4-byte float value past the end of the stack-allocated rv variable (offset 36 in the frame), corrupting adjacent stack memory.
5. Achieve objective: Depending on stack layout and mitigations present, the attacker may achieve denial of service (crash/abort), information disclosure via corrupted stack data, or arbitrary code execution by overwriting a return address or function pointer (GitHub Issue #551).

• File System: Presence of unexpected or externally sourced .icc files in user download directories, temp folders, or application data paths; filenames matching known PoC patterns such as stack-smashing-CIccTagFloatNum-CIccTagStruct-GetElemNumberValue-IccTagBasic_cpp-Line6634.icc.
• Process: Application crashes or abnormal termination of processes that use iccDEV (e.g., image editors, color management tools) when opening ICC files; AddressSanitizer output referencing CIccTagFloatNum::GetValues or IccTagBasic.cpp:6634 in crash logs.
• Logs: Application crash reports or core dumps referencing stack-buffer-overflow errors in IccProfLib/IccTagBasic.cpp or IccProfLib/IccTagComposite.cpp; error messages such as AddressSanitizer: stack-buffer-overflow in debug builds (GitHub Issue #551).

Upgrade iccDEV to version 2.3.1.3 or later, which contains the fix introduced in commit c9cb108 via PR #565. The patch corrects CIccTagFloatNum<>::GetValues() to use the caller-supplied size limit rather than the internal array size, and ensures profile data is read before the profile pointer is freed. As a temporary workaround where patching is not immediately feasible, restrict processing of ICC files to trusted sources only, implement application-level validation of ICC file integrity before processing, and educate users not to open ICC files from untrusted sources (GitHub Advisory, GitHub Commit).

Red Hat has acknowledged the vulnerability and published a tracking page for CVE-2026-25584. The vulnerability was discovered and reported by researcher xsscx, with the fix contributed by ChrisCoxArt (a named contributor to the iccDEV project). No significant broader media coverage or notable community debate has been identified beyond the GitHub issue and advisory (Red Hat, GitHub Advisory).