CVE-2026-30980: 
Homebrew vulnerability analysis and mitigation

CVE-2026-30980 is a stack overflow vulnerability in the iccDEV library's CIccBasicStructFactory::CreateStruct() function, causing uncontrolled recursion, stack exhaustion, and application crash. It affects all iccDEV versions prior to 2.3.1.5, a set of open-source libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The vulnerability was reported on February 28, 2026, the fix was merged on March 1, 2026, and the advisory was published on March 9–10, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is uncontrolled recursion (CWE-674) in CIccBasicStructFactory::CreateStruct() at IccStructFactory.cpp:93, compounded by stack-based buffer overflow conditions (CWE-121) and uncontrolled resource consumption (CWE-400). When parsing a specially crafted ICC color profile file, the function CIccTagStruct::Read() calls LoadElem(), which in turn calls SetTagStructType() and re-enters CreateStruct() without adequate bounds checking on tag sizes, creating an infinite recursive loop that exhausts the call stack. The fix, contributed by ChrisCoxArt in PR #630, adds tag size validation before entering the recursive loop to prevent infinite recursion (GitHub Issue #629, GitHub PR #630, GitHub Advisory). A proof-of-concept ICC file (so-CIccBasicStructFactory-CreateStruct-IccStructFactory_cpp-Line93.icc) was published by the reporter and used to reproduce the crash via iccDumpProfile -v (GitHub Issue #629).

Successful exploitation results in a denial-of-service condition — specifically, an application crash due to stack exhaustion — in any software that uses the iccDEV library to process ICC color profiles. There is no impact on confidentiality or data integrity; the vulnerability is limited to availability (CVSS Availability: High). Because exploitation requires local access and user interaction (opening a malicious ICC profile file), the risk of lateral movement or broad data exposure is minimal (GitHub Advisory, Feedly).

No public exploit kit or weaponized exploit is known to exist beyond the proof-of-concept ICC file published by the reporter (xsscx) as part of the bug report. There is no evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Issue #629, Feedly).

1. Craft or obtain a malicious ICC profile: Create or download a specially crafted ICC color profile file designed to trigger infinite recursion in CIccBasicStructFactory::CreateStruct(). The reporter published a PoC file (so-CIccBasicStructFactory-CreateStruct-IccStructFactory_cpp-Line93.icc) demonstrating this (GitHub Issue #629).
2. Deliver the file to the target: Use social engineering, a malicious download link, or file-sharing mechanism to get the target user to open or process the crafted ICC profile with an application built on a vulnerable version of iccDEV (< 2.3.1.5).
3. Trigger processing: The target user opens the file with a tool such as iccDumpProfile or any application that calls the iccDEV library to parse ICC profiles.
4. Stack overflow occurs: The library's CIccTagStruct::Read() → LoadElem() → SetTagStructType() → CreateStruct() call chain enters infinite recursion, exhausting the stack and causing the application to crash with a stack-overflow signal (SIGSEGV/DEADLYSIGNAL), resulting in denial of service (GitHub Issue #629, GitHub Advisory).

• Process: Application crash or abnormal termination of any process using iccDEV when processing an ICC profile file; AddressSanitizer output showing stack-overflow at CIccBasicStructFactory::CreateStruct() in IccStructFactory.cpp:93.
• Logs: Crash logs or core dumps referencing a deep call stack involving CIccTagStruct::Read(), CIccTagStruct::LoadElem(), CIccTagStruct::SetTagStructType(), and CIccBasicStructFactory::CreateStruct() in a repeating pattern.
• File System: Presence of unexpected or externally sourced .icc profile files, particularly those with unusual or deeply nested tag structures (GitHub Issue #629).

Upgrade iccDEV to version 2.3.1.5 or later, which includes the fix that validates tag sizes before entering the recursive struct creation loop. No workarounds are provided by the vendor for unpatched versions. As an additional precaution, restrict processing of ICC profile files from untrusted sources and limit user privileges when handling untrusted color profiles (GitHub Advisory, iccDEV Release v2.3.1.5).

The vulnerability was discovered and reported by security researcher xsscx using libFuzzer-based fuzzing, and the fix was developed by ChrisCoxArt, both contributors to the iccDEV project. The issue was triaged and resolved quickly — reported February 28, 2026, fixed March 1, 2026, and released in v2.3.1.5 on March 8, 2026 — reflecting a responsive open-source security process. No significant broader media coverage or notable external researcher commentary has been identified beyond the GitHub issue and advisory (GitHub Issue #629, GitHub Advisory).