CVE-2026-25634: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25634 is a stack buffer overlap (memcpy-param-overlap) vulnerability in the iccDEV library's CIccTagMultiProcessElement::Apply() function in IccTagMPE.cpp. The flaw affects all iccDEV versions prior to 2.3.1.4 and was reported on February 3, 2026, with the fix merged and released as v2.3.1.4 on February 4, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an overlapping memory range during a memcpy call at IccTagMPE.cpp:1451, where the SrcPixel and DestPixel stack buffers allocated in the same stack frame overlap when the ICC profile's m_nInputChannels value is set to 0xFFFF (CWE-119, CWE-787, CWE-123). The source of the problematic size is m_nInputChannels read from a crafted ICC profile, but the write destination is fixed stack offsets — meaning an attacker cannot control the write address to target arbitrary memory. The fix, implemented in PR #579, adds a channel count validation in CIccXformMpe::Begin() that returns icCmmStatBadXform if input/output sample counts do not match the transform's expected channel counts, preventing the overlapping copy from occurring (GitHub Issue #577, GitHub Commit).

Successful exploitation can result in memory corruption leading to denial of service, and in some contexts, arbitrary code execution with high impact to confidentiality, integrity, and availability. The attack is local and requires user interaction — specifically, a user must open or process a maliciously crafted ICC color profile file. While the attacker cannot control the write destination (fixed stack offsets), the memory corruption could enable privilege escalation or complete system compromise in vulnerable environments (GitHub Advisory, GitHub Issue #577).

A proof-of-concept exploit consisting of a crafted TIFF and ICC file pair is publicly available on GitHub, along with reproduction steps using the iccApplyProfiles tool (GitHub Issue #577). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.012% (0.000120), indicating a low probability of exploitation in the near term (Feedly).

1. Craft malicious ICC profile: Create or obtain a specially crafted ICC profile file with m_nInputChannels set to 0xFFFF (65535), which causes the SrcPixel and DestPixel stack buffers to overlap during processing.
2. Pair with a TIFF image: Combine the malicious .icc profile with a TIFF image file (as demonstrated in the public PoC: memcpy-param-overlap-CIccTagMultiProcessElement-Apply-IccTagMPE_cpp-Line1451.tiff and .icc).
3. Deliver to target: Trick a user into opening the malicious TIFF/ICC pair using an application that relies on the iccDEV library (e.g., via email attachment, download, or shared file).
4. Trigger vulnerable code path: When the application processes the ICC profile, CIccTagMultiProcessElement::Apply() is called, executing a memcpy at IccTagMPE.cpp:1451 with overlapping source and destination stack buffers.
5. Achieve memory corruption: The overlapping memcpy corrupts stack memory, potentially causing a crash (DoS) or, under favorable conditions, enabling arbitrary code execution in the context of the processing application (GitHub Issue #577).

• File System: Presence of unexpected .icc or .tiff files with unusually large channel count fields (e.g., m_nInputChannels = 0xFFFF) in directories processed by iccDEV-based applications.
• Logs: Application crash logs or AddressSanitizer output referencing memcpy-param-overlap in CIccTagMultiProcessElement::Apply() at IccTagMPE.cpp:1451; error messages such as AddressSanitizer: memcpy-param-overlap involving SrcPixel and DestPixel stack variables.
• Process: Unexpected termination or crash of image-processing applications (e.g., iccApplyProfiles) when processing ICC profiles from untrusted sources; abnormal child processes spawned from image-processing tools (GitHub Issue #577).

Upgrade iccDEV to version 2.3.1.4 or later, which includes the fix that validates input/output channel counts before applying transforms in CIccXformMpe::Begin() (GitHub Release v2.3.1.4). Until patching is complete, restrict user access to untrusted ICC profile files, disable automatic processing of ICC profiles from untrusted sources, and implement file scanning or input validation for ICC profiles before processing. Organizations should also monitor for unexpected crashes in applications using the iccDEV library (GitHub Advisory).

The vulnerability was reported and fixed rapidly — discovered February 3, 2026, patched and released as v2.3.1.4 by February 4, 2026. The security advisory was published by researcher xsscx, with the fix contributed by ChrisCoxArt (a project maintainer). Red Hat acknowledged the CVE in their security tracking system. Brief coverage appeared on Mastodon via @thehackerwire and was indexed by multiple vulnerability aggregators shortly after disclosure (GitHub Advisory, Red Hat CVE).