CVE-2026-27691: 
Homebrew vulnerability analysis and mitigation

CVE-2026-27691 is a signed integer overflow vulnerability in the parse3DTable() function of iccFromCube.cpp (line 218) within the iccDEV library, a set of tools for working with ICC color management profiles maintained by the International Color Consortium. The flaw affects iccDEV versions up to and including 2.3.1.4 and was reported on February 20, 2026, with a fix merged on February 23, 2026, and the CVE published on February 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, and 6.2 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause is a signed integer overflow (CWE-190) combined with incorrect numeric type conversion (CWE-681) in the parse3DTable() function within Tools/CmdLine/IccFromCube/iccFromCube.cpp at line 218. When processing a crafted or oversized CUBE file, the expression m_sizeLut3D * m_sizeLut3D * m_sizeLut3D is computed using signed int arithmetic, which can overflow when large LUT size values are supplied — for example, -1156317184 * -1156317184 cannot be represented as int, triggering undefined behavior (UB) as detected by UndefinedBehaviorSanitizer. The fix replaces the multiplication with uint64_t intermediate types and adds bounds checks before casting back to icUInt32Number, and also validates the LUT_3D_SIZE field using int64_t before assignment (GitHub Issue, GitHub Commit).

Successful exploitation causes undefined behavior that can crash the iccFromCube tool (denial of service) or produce silently incorrect ICC profiles, compromising color management integrity in applications that depend on the generated profiles. There is no demonstrated confidentiality or integrity impact beyond incorrect output; the vulnerability is limited in scope to the local process handling the malicious input. Lateral movement potential is minimal given the local attack vector and the specialized nature of the affected tool (GitHub Advisory, Feedly).

A proof-of-concept (PoC) exploit file (ub_sio_parse3Dtable-IccFromCube_cpp-Line218.icc) is publicly available on GitHub, hosted in the reporter's fuzzing repository. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.012% (0.000120), reflecting very low probability of exploitation in the near term (GitHub Issue, Feedly).

1. Obtain the tool: Build iccFromCube from the iccDEV repository (version ≤ 2.3.1.4) with sanitizers enabled: CC=clang CXX=clang++ cmake ... -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined -fno-sanitize-recover=address,undefined".
2. Prepare a crafted CUBE file: Create or download a malformed .icc CUBE file containing a LUT_3D_SIZE value large enough to cause signed integer overflow when cubed (e.g., the PoC file ub_sio_parse3Dtable-IccFromCube_cpp-Line218.icc from https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/ub_sio_parse3Dtable-IccFromCube_cpp-Line218.icc).
3. Execute the tool with the crafted input: Run iccFromCube input.icc output.icc, passing the malicious file as input.
4. Trigger undefined behavior: The parse3DTable() function at line 218 performs m_sizeLut3D * m_sizeLut3D * m_sizeLut3D using signed int, overflowing and triggering UB, resulting in a crash or corrupted output profile (GitHub Issue, GitHub Advisory).

• Process: Crash or abnormal termination of the iccFromCube process when processing a CUBE input file; UndefinedBehaviorSanitizer output containing runtime error: signed integer overflow referencing iccFromCube.cpp:218.
• Logs: Application error logs showing Unable to parse LUT from '<filename>' or unexpected exit codes (-4) from iccFromCube.
• File System: Presence of unexpected or externally supplied .icc CUBE files with unusually large LUT_3D_SIZE values in directories processed by iccDEV tools (GitHub Issue).

Update iccDEV to a version containing commit 43ae18dd69fc70190d3632a18a3af2f3da1e052a, which introduces safe uint64_t intermediate arithmetic, bounds validation on LUT_3D_SIZE, and early-exit error handling in parse3DTable() and CIccCLUT::Init(). No configuration-based workarounds are available for unpatched versions. As an interim measure, restrict processing of untrusted or user-supplied CUBE/ICC input files until the patch is applied (GitHub Advisory, GitHub Commit).