CVE-2026-30981: 
Homebrew vulnerability analysis and mitigation

CVE-2026-30981 is a heap-buffer-overflow read vulnerability in iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The flaw exists in the CIccXmlArrayType<>::DumpArray() function located in IccUtilXml.cpp at line 869, causing out-of-bounds reads and/or application crashes. All iccDEV versions prior to 2.3.1.5 are affected. The vulnerability was reported on February 28, 2026, patched via PR #631 merged on March 1, 2026, and publicly disclosed on March 10, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Feedly).

The root cause is insufficient bounds checking in CIccXmlArrayType<>::DumpArray() when processing ICC profile data, classified under CWE-122 (Heap-based Buffer Overflow), CWE-125 (Out-of-bounds Read), and CWE-787 (Out-of-bounds Write). The vulnerability is triggered when the iccToXml tool processes a specially crafted ICC profile file containing a malformed CIccTagSparseMatrixArray tag — the matrix row/column counts are not validated after reading, allowing the DumpArray() function to read 2 bytes past the end of a 3072-byte heap-allocated region. Exploitation requires local access and user interaction (opening a malicious .icc file). A proof-of-concept ICC file and AddressSanitizer output were published in GitHub Issue #627, demonstrating the crash at IccUtilXml.cpp:869 (GitHub Issue, GitHub PR).

Successful exploitation causes an application crash (denial of service) and may result in limited information disclosure through out-of-bounds memory reads. The confidentiality impact is low (partial memory content exposure), integrity is unaffected, and availability impact is high due to the crash. Because the attack vector is local and requires user interaction to open a crafted ICC profile, the blast radius is limited to the affected workstation and the user's session — lateral movement potential is minimal (GitHub Advisory, Feedly).

A proof-of-concept ICC file (hbo-CIccXmlArrayType-icTagTypeSignature-IccUtilXml_cpp-Line869.icc) is publicly available in the researcher's GitHub repository and was used to reproduce the crash during triage. There is no evidence of in-the-wild exploitation or threat actor attribution. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term (GitHub Issue, Feedly).

1. Craft or obtain a malicious ICC profile: Use the publicly available PoC file (hbo-CIccXmlArrayType-icTagTypeSignature-IccUtilXml_cpp-Line869.icc) from the researcher's repository, or craft a custom ICC profile with a malformed CIccTagSparseMatrixArray tag where the matrix row/column counts exceed the actual allocated buffer size.
2. Deliver the file to the target: Social-engineer the target user into opening the malicious .icc file, or place it in a directory where iccDEV tools are invoked automatically (e.g., a watched folder for color profile processing).
3. Trigger processing: The target user or an automated process runs iccToXml <malicious.icc> output.xml, causing iccDEV to parse the ICC profile and invoke CIccTagSparseMatrixArray::Read(), which allocates a heap buffer without validating row/column counts.
4. Trigger out-of-bounds read: During XML serialization, CIccXmlArrayType<>::DumpArray() at IccUtilXml.cpp:869 reads 2 bytes past the end of the allocated 3072-byte heap region, triggering a heap-buffer-overflow.
5. Achieve objective: The application crashes (denial of service), and heap memory adjacent to the buffer may be disclosed in error output or crash dumps, potentially leaking sensitive runtime data (GitHub Issue, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .icc files in directories processed by iccDEV tools; PoC file named hbo-CIccXmlArrayType-icTagTypeSignature-IccUtilXml_cpp-Line869.icc or similar.
• Process: Unexpected crashes or abnormal termination of iccToXml or other iccDEV-based tools; AddressSanitizer output referencing CIccXmlArrayType::DumpArray at IccUtilXml.cpp:869.
• Logs: Application crash logs or core dumps from processes invoking iccToXml; error messages containing heap-buffer-overflow or READ of size 2 at the iccDEV library address space (GitHub Issue).

The fix is available in iccDEV version 2.3.1.5, released on March 8, 2026, which validates matrix row and column counts after reading before passing data to DumpArray(). Users should upgrade to v2.3.1.5 or later immediately. No official workarounds are provided by the maintainers. As interim measures, restrict access to ICC profile processing tools to trusted users, avoid processing ICC files from untrusted sources, and consider sandboxing applications that invoke iccDEV libraries (GitHub Release, GitHub Advisory).

The vulnerability was discovered and reported by security researcher xsscx via libFuzzer-based fuzzing, with the fix contributed by ChrisCoxArt (a project maintainer). The issue was triaged and patched within one day of reporting, reflecting a responsive disclosure process. No significant broader media coverage or notable community commentary beyond the GitHub issue and advisory has been observed (GitHub Issue, GitHub PR).