CVE-2026-25585: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25585 is an out-of-bounds read vulnerability in the CIccXform3DLut::Apply() function of iccDEV, a set of libraries and tools for ICC color management profile processing. The flaw exists at IccCmm.cpp:5793, where a malformed ICC profile triggers improper array bounds validation, allowing reads beyond the allocated array boundary. It affects all iccDEV versions prior to 2.3.1.3 and was disclosed on February 4, 2026. The CVSS v3.1 base score is 7.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper validation of array indices (CWE-129) and improper restriction of memory buffer operations (CWE-119, CWE-125, CWE-787) in the CIccXform3DLut::Apply() function within IccProfLib/IccCmm.cpp at line 5793. When processing a malformed ICC profile, the color management module fails to validate that the array index stays within bounds of a float[16] array (icFloatNumber[16]), resulting in an index-16-out-of-bounds read. Exploitation requires a local attacker to craft a malicious ICC profile file and have a victim open or process it with an application using the vulnerable iccDEV library. The fix, implemented in PR #563, adds channel count validation (m_nInput > 15 || m_nOutput > 15) across multiple LUT tag read functions in IccTagLut.cpp (GitHub Issue, Fix Commit).

Successful exploitation can result in disclosure of sensitive data from adjacent memory regions or a segmentation fault causing application crashes. An attacker who tricks a user into processing a crafted ICC profile could read memory beyond the intended buffer boundary, potentially exposing in-process data. In some contexts, the advisory notes that memory corruption in downstream image-processing libraries could lead to arbitrary code execution, though this is considered a less likely outcome (GitHub Advisory).

A proof-of-concept (PoC) exploit in the form of a malformed ICC profile file (ub-runtime-error-index16-oob-IccCmm_cpp-Line5793.icc) is publicly available on GitHub and was used to reproduce the vulnerability during triage (GitHub Issue). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft malicious ICC profile: Create or obtain a malformed ICC profile file with manipulated tag tables, offsets, or size fields that cause the input/output channel count to exceed 15 (e.g., index 16 into a float[16] array). A public PoC file (ub-runtime-error-index16-oob-IccCmm_cpp-Line5793.icc) is available at https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/ub-runtime-error-index16-oob-IccCmm_cpp-Line5793.icc.
2. Deliver the malicious file: Distribute the crafted ICC profile to a target user via email attachment, file share, or embedding it in an image or document that triggers ICC profile processing.
3. Trigger processing: Induce the victim to open the file with an application that uses the vulnerable iccDEV library (e.g., running iccRoundTrip ub-runtime-error-index16-oob-IccCmm_cpp-Line5793.icc).
4. Achieve out-of-bounds read: The CIccXform3DLut::Apply() function at IccCmm.cpp:5793 reads beyond the float[16] array boundary, resulting in memory disclosure or a segmentation fault/crash (GitHub Issue, GitHub Advisory).

• File System: Presence of unexpected or unknown .icc profile files in user directories, temporary folders, or application data paths; specifically files with anomalous tag table structures or oversized channel count fields.
• Process: Application crashes (segmentation faults) in processes that use the iccDEV library when processing ICC profiles; crash dumps referencing IccCmm.cpp:5793 or CIccXform3DLut::Apply().
• Logs: UndefinedBehaviorSanitizer (UBSan) or AddressSanitizer (ASan) output containing runtime error: index 16 out of bounds for type 'icFloatNumber[16]' in application logs; crash reports from image-processing applications referencing IccProfLib/IccCmm.cpp:5793 (GitHub Issue).

Upgrade iccDEV to version 2.3.1.3 or later, which includes the fix that validates input and output channel counts (rejecting values greater than 15) across multiple LUT tag read functions (Fix Commit, GitHub Advisory). No official workarounds are provided by the vendor. As interim mitigations, restrict user access to untrusted ICC color profile files, disable automatic ICC profile loading from untrusted sources, and implement file validation controls to prevent processing of ICC profiles from unknown origins.

The vulnerability was reported by security researcher xsscx and remediated by ChrisCoxArt (a contributor to the iccDEV project), with the fix merged on February 2, 2026 (GitHub PR). Brief mentions appeared on social media platforms including Mastodon and Bluesky via TheHackerWire shortly after disclosure. A technical write-up was published by Infinit Security at https://infinitsec.net/posts/cve-2026-25585-iccdev-vulnerable-to-oob-in-ciccxform3dlutapply. Red Hat also tracked the vulnerability in their security advisory database (Red Hat CVE).