CVE-2026-27692: 
Homebrew vulnerability analysis and mitigation

CVE-2026-27692 is a heap buffer overflow read vulnerability in iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The flaw affects all versions up to and including 2.3.1.4, where strlen() reads past a heap buffer during CIccTagTextDescription::Release() while parsing ICC profile XML text description tags, causing a crash. It was discovered and reported by researcher xsscx on February 23, 2026, with the advisory published on February 25, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper null termination (CWE-170) in the GetBuffer() function within IccProfLib/IccTagBasic.cpp. Specifically, the buffer size tracking variable m_nASCIISize was set to nSize rather than nSize+1, failing to account for the null terminator. When CIccTagTextDescription::Release() subsequently calls strlen() on the resulting buffer, it reads one byte past the allocated heap region, triggering a heap-buffer-overflow read (CWE-125) and potentially an out-of-bounds write (CWE-787). Exploitation requires a local attacker to supply a maliciously crafted ICC profile XML file that is then processed by the iccFromXml tool or any application using the iccDEV library — user interaction is required to open or convert the file (GitHub Issue #609, GitHub Advisory, Fix Commit).

Successful exploitation can cause the affected application to crash (denial of service) and may allow an attacker to read heap memory contents beyond the intended buffer boundary, resulting in potential disclosure of sensitive in-memory data (confidentiality impact: High, availability impact: High, integrity impact: None). The attack is local in scope and requires user interaction, limiting its reach to scenarios where a victim processes a malicious ICC profile file. There is no evidence of lateral movement potential or privilege escalation beyond memory disclosure and application crash (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available as a crafted XML file hosted on GitHub, demonstrated via AddressSanitizer output showing the heap-buffer-overflow condition (GitHub Issue #609). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Obtain the PoC payload: Download the malicious ICC profile XML file from the public repository: wget https://github.com/xsscx/fuzz/raw/refs/heads/master/xml/icc/hbo-CIccTagTextDescription-Release-IccTagBasic_cpp-Line2350.xml
2. Identify a vulnerable target: Confirm the target system is running iccDEV version 2.3.1.4 or earlier, specifically with the iccFromXml tool or an application that uses the iccDEV library to parse ICC profile XML files.
3. Deliver the malicious file: Provide the crafted XML file to the victim (e.g., via email, shared storage, or social engineering) and induce the victim to process it with the vulnerable application.
4. Trigger the overflow: When the victim runs iccFromXml hbo-CIccTagTextDescription-Release-IccTagBasic_cpp-Line2350.xml foo.bar, the parser calls CIccTagXmlTextDescription::ParseXml(), which invokes CIccTagTextDescription::Release(), causing strlen() to read one byte past the heap buffer boundary.
5. Observe the outcome: The application crashes with a heap-buffer-overflow error, and depending on heap layout, adjacent heap memory contents may be disclosed to the attacker (GitHub Issue #609, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .xml files with ICC profile structure (e.g., containing namedColor2Type or textDescriptionType tags) in directories processed by iccDEV tools; specifically files matching the pattern used in the PoC (hbo-CIccTagTextDescription-Release-IccTagBasic_cpp-Line2350.xml).
• Process: Abnormal termination (crash/abort) of iccFromXml or any application linking against iccDEV libraries when processing XML-based ICC profile files.
• Logs: AddressSanitizer or system crash logs referencing CIccTagTextDescription::Release() at IccTagBasic.cpp:2350, strlen heap-buffer-overflow errors, or ABORTING signals from iccDEV processes; core dump files generated by the iccDEV process.
• Network: Download of ICC profile XML files from untrusted or unexpected external sources to systems running iccDEV tools (GitHub Issue #609).

Update iccDEV to a version newer than 2.3.1.4 that includes the fix introduced in commit 29d088840b962a7cdd35993dfabc2cb35a049847, which corrects the buffer size calculation in GetBuffer() to include the null terminator (m_nASCIISize = nSize+1). No configuration-based workarounds are available. As an interim measure, restrict processing of untrusted or externally sourced ICC profile XML files and limit access to applications that use iccDEV libraries (Fix Commit, GitHub PR #610, GitHub Advisory).