CVE-2026-30982: 
Homebrew vulnerability analysis and mitigation

CVE-2026-30982 is a heap out-of-bounds read vulnerability in iccDEV, the International Color Consortium's open-source library and toolset for working with ICC color management profiles. The flaw exists in the CIccPcsXform::pushXYZConvert() function (specifically at IccCmm.cpp:3000) and affects all iccDEV versions prior to 2.3.1.5. It was discovered and reported on February 28, 2026, with a fix merged on March 1, 2026, and the patched release (v2.3.1.5) published on March 8, 2026. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is improper validation of array index (CWE-129) combined with a heap-based buffer overflow/out-of-bounds read (CWE-122, CWE-125) in CIccPcsXform::pushXYZConvert(). When processing a specially crafted ICC color profile, the function fails to validate that the size of a matrix (allocated via CIccMpeMatrix::SetSize()) matches the expected dimensions before reading from it, resulting in a read of 4 bytes past the end of a heap-allocated 4-byte region. Exploitation requires a local attacker to supply a malicious ICC profile file to an application using the vulnerable library, with user interaction required to trigger profile processing. A public proof-of-concept reproducer (two crafted .icc files) was published alongside the issue report and can be triggered via the iccApplyNamedCmm command-line tool (GitHub Issue #625, GitHub Advisory).

Successful exploitation causes an application crash (denial of service) due to the out-of-bounds heap read, and may also leak heap memory contents, posing a low confidentiality risk. The availability impact is rated High, while confidentiality impact is Low and there is no integrity impact. The attack is constrained to local access with required user interaction, limiting the scope to applications that process untrusted ICC color profile files using the vulnerable iccDEV library (GitHub Advisory, Feedly).

A public proof-of-concept reproducer was published by the reporter (xsscx) as part of the GitHub issue disclosure on February 28, 2026, consisting of two crafted ICC profile files and a command-line invocation. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Issue #625, Feedly).

1. Obtain malicious ICC profile files: Download or craft two specially malformed ICC color profile files (e.g., hbo-CIccPcsXform-pushXYZConvert-IccCmm_cpp-Line3000.icc and the corresponding -part2.icc) that trigger the out-of-bounds read when processed together.
2. Identify a vulnerable target: Locate a system running iccDEV prior to version 2.3.1.5, or an application that embeds the vulnerable library for ICC color profile processing.
3. Deliver the malicious profiles: Provide the crafted ICC files to the target application — for example, via the iccApplyNamedCmm command-line tool or any application that accepts user-supplied color profiles.
4. Trigger the vulnerability: Execute the application with the malicious profiles as input (e.g., printf "'RGB '\nicEncodeFloat\n0.5\t0.5\t0.5\n" | iccApplyNamedCmm /dev/stdin 3 1 malicious1.icc 1 malicious2.icc 1). This causes CIccPcsXform::pushXYZConvert() at IccCmm.cpp:3000 to read 4 bytes past the end of a heap-allocated buffer.
5. Achieve objective: The application crashes (denial of service), and heap memory contents adjacent to the allocation may be exposed, potentially leaking sensitive in-process data (GitHub Issue #625).

• Process: Unexpected crashes or aborts of applications using iccDEV when processing ICC color profile files; AddressSanitizer reports of heap-buffer-overflow in CIccPcsXform::pushXYZConvert() at IccCmm.cpp:3000.
• Logs: Application crash logs or core dumps referencing CIccPcsXform::pushXYZConvert, CIccPcsXform::Connect, CIccCmm::CheckPCSConnections, or CIccNamedColorCmm::Begin in stack traces; error messages such as AddressSanitizer: heap-buffer-overflow on address ... READ of size 4.
• File System: Presence of unexpected or externally sourced .icc color profile files in directories processed by iccDEV-based applications, particularly files with anomalous matrix element counts in multi-process element (MPE) tags (GitHub Issue #625).

The fix is available in iccDEV version 2.3.1.5, released March 8, 2026. The patch (PR #632, commit cfdc728) adds validation to ensure the matrix size matches the expected dimensions before reading, preventing the out-of-bounds access. No workarounds are provided by the vendor; upgrading to v2.3.1.5 or later is the recommended remediation. As an interim measure, organizations should restrict processing of ICC color profiles from untrusted sources and monitor for application crashes related to color profile handling (GitHub Advisory, GitHub Release v2.3.1.5, GitHub PR #632).