CVE-2026-30978: 
Homebrew vulnerability analysis and mitigation

CVE-2026-30978 is a heap-use-after-free vulnerability in the CIccCmm::AddXform() function of iccDEV, a library and toolset for working with ICC color management profiles maintained by the International Color Consortium. The flaw causes an invalid virtual pointer (vptr) dereference, leading to application crashes and potentially arbitrary code execution. All iccDEV versions prior to 2.3.1.5 are affected. The vulnerability was reported on February 23, 2026, patched on February 24, 2026, and publicly disclosed on March 10, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat).

The root cause is a use-after-free condition (CWE-416, CWE-672, CWE-825) in IccCmm.cpp at line 8320. Specifically, within CIccCmm::AddXform(), a CIccProfile object is freed by CIccXform::Create() before the calling function attempts to access it, resulting in a member access on a freed heap region with an invalid vptr. The vulnerability is triggered locally when a user opens or processes a specially crafted malicious ICC color profile file (e.g., via the iccApplyProfiles tool). The issue was discovered through libFuzzer-based fuzzing and confirmed with AddressSanitizer and UndefinedBehaviorSanitizer output showing a READ of size 4 on a freed 208-byte heap region (GitHub Issue #612, GitHub Advisory). The fix, merged in PR #616, adds a profile validity check before CreateXform can delete the profile (GitHub PR #616).

Successful exploitation can result in high impact to confidentiality, integrity, and availability. An attacker who tricks a user into processing a malicious ICC profile file could achieve arbitrary code execution in the context of the application, potentially enabling data theft, system state modification, or denial of service via crash. The attack is local and requires user interaction, limiting its scope, but the high-impact triad across all three CIA pillars makes it a significant risk for systems that process untrusted color profile files (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction (opening a malicious ICC profile), which further reduces the practical attack surface (Red Hat, GitHub Advisory).

1. Craft a malicious ICC profile: Create or obtain a specially crafted ICC color profile file (.icc) designed to trigger the heap-use-after-free in CIccCmm::AddXform(). A reference PoC file (huaf-CIccCmm-AddXform-IccCmm_cpp-Line8320.icc) was used during vulnerability discovery and is publicly referenced.
2. Deliver the malicious file: Social-engineer the target user into downloading or receiving the malicious .icc file, for example via email attachment, file share, or embedding it in a workflow that processes color profiles.
3. Trigger processing: Cause the victim to process the malicious ICC profile using a vulnerable iccDEV tool or application, such as running: iccApplyProfiles test_8x8.tif /tmp/out.tif 2 1 0 0 0 malicious.icc 0
4. Exploit the use-after-free: When CIccCmm::AddXform() is called, the CIccProfile object is freed internally by CIccXform::Create(), but the function continues to access the freed memory at IccCmm.cpp:8320, resulting in an invalid vptr dereference.
5. Achieve code execution or crash: Depending on heap layout and memory reuse, the attacker may achieve arbitrary code execution in the context of the running process, or at minimum cause a denial-of-service crash (GitHub Issue #612, GitHub Advisory).

• File System: Presence of unexpected or unknown .icc files in user download directories, temp folders (/tmp/), or directories used by color management workflows; malicious ICC profile files with anomalous structure detectable by ICC profile validators.
• Process: Application crashes or abnormal termination of processes using iccDEV libraries (e.g., iccApplyProfiles); AddressSanitizer or UndefinedBehaviorSanitizer output referencing IccCmm.cpp:8320 in development/test environments.
• Logs: System crash logs or core dumps associated with iccDEV tools; error messages containing heap-use-after-free or invalid vptr related to CIccCmm::AddXform() (GitHub Issue #612).

The vulnerability is fixed in iccDEV version 2.3.1.5, released on March 8, 2026. Users should upgrade to v2.3.1.5 or later immediately. No official workarounds are provided by the vendor. As interim mitigations, organizations should restrict processing of ICC color profile files from untrusted sources, implement sandboxing for color profile processing workflows, and educate users not to open ICC profile files from unknown origins (GitHub Release v2.3.1.5, GitHub Advisory).

The vulnerability received limited but focused attention from the security community. It was referenced in an AI threat intelligence tracking repository (Argus) and noted on social media platforms including Bluesky and Nitter/Twitter via the CVEnew account. Red Hat also tracked the CVE in their security advisory database. No major vendor statements or widespread media coverage have been identified beyond standard vulnerability aggregator reporting.