CVE-2026-30984: 
Homebrew vulnerability analysis and mitigation

CVE-2026-30984 is a heap out-of-bounds read vulnerability in the iccDEV library, specifically within the CIccCalculatorFunc::ApplySequence() function in IccProfLib/IccMpeCalc.cpp (line 3711). iccDEV is an open-source set of libraries and tools maintained by the International Color Consortium for working with ICC color management profiles. All versions prior to 2.3.1.5 are affected. The vulnerability was reported on February 25, 2026, patched on March 1, 2026, and publicly disclosed via a GitHub Security Advisory on March 9–10, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is improper validation of array indices (CWE-129) combined with an out-of-bounds read (CWE-125) in the CIccCalculatorFunc::ApplySequence() function. When processing a specially crafted ICC color profile file, the function reads 4 bytes immediately past the end of a heap-allocated buffer (28,488 bytes) without first validating that the offset is within bounds. The fix, introduced in PR #635, adds offset validation before calling ApplySequence(). Exploitation requires local access and user interaction — a victim must open or process a malicious .icc profile file using an application linked against the vulnerable library. A public proof-of-concept ICC file and reproduction steps were provided in the original issue report (GitHub Issue #623, GitHub PR #635).

Successful exploitation causes an application crash (denial of service) due to the heap buffer overflow read triggering an AddressSanitizer abort or equivalent runtime fault. There is a low-severity confidentiality impact, as the out-of-bounds read may expose a small amount of adjacent heap memory contents before the crash occurs. Integrity is not affected. The scope is limited to the process running the vulnerable iccDEV library; lateral movement or privilege escalation are not directly enabled by this vulnerability (GitHub Advisory).

A public proof-of-concept ICC file (hbo-CIccCalculatorFunc-ApplySequence-IccMpeCalc_cpp-Line3715.icc) and reproduction steps were published in the GitHub issue tracker at the time of disclosure, making the vulnerability straightforward to reproduce (GitHub Issue #623). There is no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Obtain the malicious ICC profile: Download or craft a specially structured ICC profile file that triggers the out-of-bounds read, such as the publicly available PoC: wget https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/hbo-CIccCalculatorFunc-ApplySequence-IccMpeCalc_cpp-Line3715.icc
2. Identify a target application: Find an application that uses a vulnerable version of iccDEV (< 2.3.1.5) to process ICC profiles, such as the bundled iccApplyNamedCmm tool or any third-party software linking against the library.
3. Deliver the malicious file: Provide the crafted ICC profile to the target application, either directly (e.g., via a file open dialog, command-line argument, or by placing it in a directory the application monitors).
4. Trigger processing: Cause the application to process the ICC profile. For example: printf "'RGB '\nicEncodeFloat\n0.5 0.5 0.5\n" | Tools/IccApplyNamedCmm/iccApplyNamedCmm /dev/stdin 3 0 <malicious.icc> 0
5. Achieve denial of service: The CIccCalculatorFunc::ApplySequence() function reads 4 bytes past the end of the allocated heap buffer at IccMpeCalc.cpp:3711, causing an application crash and potential exposure of adjacent heap memory (GitHub Issue #623).

• File System: Presence of unexpected or externally sourced .icc profile files in application directories or temporary folders, particularly files with unusual sizes or structures that do not conform to standard ICC profile formats.
• Process: Application crashes or abnormal termination of processes linked against iccDEV when processing ICC profile files; crash dumps referencing IccMpeCalc.cpp or CIccCalculatorFunc::ApplySequence().
• Logs: AddressSanitizer output containing heap-buffer-overflow at IccProfLib/IccMpeCalc.cpp:3711 in CIccCalculatorFunc::ApplySequence(); application error logs showing unexpected exits or segmentation faults during ICC profile processing (GitHub Issue #623).

Upgrade iccDEV to version 2.3.1.5 or later, which includes the fix that validates array offsets before calling ApplySequence() (GitHub Release v2.3.1.5). No official workarounds are provided by the maintainers. As a defense-in-depth measure, restrict applications from processing ICC profile files from untrusted or unknown sources, and educate users not to open ICC profiles received from external parties (GitHub Advisory).

The vulnerability was discovered and reported by security researcher xsscx using libFuzzer-based fuzzing, with the fix contributed by ChrisCoxArt. The issue was triaged and patched promptly within approximately four days of the initial report (February 25 to March 1, 2026). No significant broader media coverage or notable community commentary beyond the GitHub repository activity has been identified.