CVE-2026-30979: 
Homebrew vulnerability analysis and mitigation

CVE-2026-30979 is a heap-based buffer overflow vulnerability in iccDEV, the International Color Consortium's set of libraries and tools for working with ICC color management profiles. The flaw exists in the CIccCalculatorFunc::InitSelectOp() function and is triggered through local user interaction, causing memory corruption or application crash. All iccDEV versions prior to 2.3.1.5 are affected. It was reported on February 24, 2026, patched on February 25, 2026, and publicly disclosed on March 10, 2026, with a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is a classic buffer overflow (CWE-120), specifically a heap-based buffer overflow (CWE-122) with an out-of-bounds write (CWE-787), located at IccMpeCalc.cpp:3663 in the CIccCalculatorFunc::InitSelectOp() function. The vulnerability occurs because the function does not properly validate array bounds when iterating over sel/case statements, allowing a read past the end of a heap-allocated buffer. Exploitation requires a local attacker to supply a specially crafted malicious ICC profile file and have the victim open or process it with an iccDEV tool such as iccRoundTrip. A public proof-of-concept ICC file (hbo-CIccCalculatorFunc-InitSelectOp-IccMpeCalc_cpp-Line3663.icc) was published by the reporter (xsscx) alongside the issue, and AddressSanitizer output confirmed a heap-buffer-overflow at the identified location (GitHub Issue #617, GitHub Advisory).

Successful exploitation can result in memory corruption, application crash (denial of service), and potentially arbitrary code execution on the affected system. The CVSS scoring reflects high impacts to confidentiality, integrity, and availability, meaning an attacker could potentially read sensitive memory contents, corrupt data, or gain code execution in the context of the process handling the malicious ICC profile. The attack is constrained to local access with required user interaction, limiting the scope to systems where users process untrusted ICC profile files (GitHub Advisory, Feedly).

A proof-of-concept ICC file demonstrating the vulnerability was published by the reporter (xsscx) as part of the original bug report on February 24, 2026, making reproduction straightforward (GitHub Issue #617). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term (Feedly). This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Prepare the malicious ICC profile: Obtain or craft a specially malformed ICC profile file that triggers the out-of-bounds read in CIccCalculatorFunc::InitSelectOp(). The reporter's PoC file is publicly available: wget https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/hbo-CIccCalculatorFunc-InitSelectOp-IccMpeCalc_cpp-Line3663.icc
2. Deliver the file to the target: Social-engineer or otherwise cause a local user on the target system to process the malicious ICC profile using an iccDEV tool (e.g., via a shared directory, email attachment, or embedded in a document).
3. Trigger the vulnerability: The victim runs iccRoundTrip hbo-CIccCalculatorFunc-InitSelectOp-IccMpeCalc_cpp-Line3663.icc or another iccDEV tool that invokes the vulnerable code path through CIccCalculatorFunc::Begin() → InitSelectOps() → InitSelectOp().
4. Achieve impact: The heap-buffer-overflow is triggered at IccMpeCalc.cpp:3663, resulting in memory corruption. Depending on heap layout and system mitigations, this may cause an application crash (DoS) or, in a worst case, enable arbitrary code execution in the context of the running process (GitHub Issue #617, GitHub Advisory).

• File System: Presence of unexpected or unknown .icc profile files in user directories, temporary folders, or shared locations, particularly files with unusual sizes or structures that fail normal ICC validation.
• Process: Abnormal termination (crash) of iccDEV tools such as iccRoundTrip, iccApplyProfiles, or other ICC processing utilities; crash dump files generated by these processes.
• Logs: AddressSanitizer or system crash logs referencing CIccCalculatorFunc::InitSelectOp() in IccMpeCalc.cpp:3663; application error logs showing heap corruption or segmentation faults from iccDEV binaries.
• Network: Download of .icc files from untrusted or unexpected external sources in web proxy or endpoint logs (GitHub Issue #617).

Upgrade iccDEV to version 2.3.1.5 or later, which contains the fix introduced in PR #622 (commit d8f2656) that adds proper bounds checking to prevent running past the end of the array in sel/case statement processing (iccDEV Release v2.3.1.5, GitHub PR #622). No official workarounds are provided by the maintainers. As an interim measure, avoid processing untrusted or unknown ICC profile files with iccDEV tools until the patch is applied (GitHub Advisory).

The vulnerability received limited but focused attention from the security community, with brief mentions on Mastodon and Bluesky shortly after disclosure. The issue was discovered through libFuzzer-based fuzzing by researcher xsscx, who also reported several other heap-buffer-overflow and stack-overflow issues in iccDEV around the same time (issues #617–#629), suggesting a broader fuzzing campaign against the library. No major media coverage or vendor statements beyond the GitHub advisory have been identified.