CVE-2026-30985: 
Homebrew vulnerability analysis and mitigation

CVE-2026-30985 is a heap-based buffer overflow vulnerability in the CIccMatrixMath::SetRange() function of iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The vulnerability affects all iccDEV versions prior to 2.3.1.5 and can lead to memory corruption or application crash. It was reported on February 25, 2026, the fix was merged on March 1, 2026, and the advisory (GHSA-f9wv-cq46-f9wg) was published on March 9, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is a heap-based buffer overflow write (CWE-122, CWE-787, CWE-120) in CIccMatrixMath::SetRange() at IccProfLib/IccMatrixMath.cpp:379, where the function copies data into a heap-allocated buffer without adequately validating the size of the input against the buffer's bounds. The vulnerability is triggered when a specially crafted ICC profile file is processed — specifically when CIccMatrixMath::rangeMap() calls SetRange() with mismatched spectral range parameters, causing a 4-byte out-of-bounds write on the heap. Exploitation requires local access and user interaction (e.g., opening or processing a malicious .icc file). A proof-of-concept ICC file and reproduction steps were publicly disclosed in GitHub Issue #621, including an AddressSanitizer trace confirming the write at the vulnerable location (GitHub Issue #621, GitHub Advisory).

Successful exploitation can result in memory corruption or application crash, with potential high impacts on confidentiality, integrity, and availability of the affected process. An attacker who can convince a user to process a malicious ICC profile file could potentially read sensitive data from heap memory, corrupt application state, or cause a denial of service. The attack is constrained to local access and requires user interaction, limiting the scope to the affected application's security boundary (GitHub Advisory, Feedly).

A proof-of-concept ICC file (hbo-CIccMatrixMath-SetRange-IccMatrixMath_cpp-Line379.icc) was publicly disclosed in GitHub Issue #621 by the reporter (xsscx), along with exact reproduction steps using the iccApplyNamedCmm tool. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Issue #621, Feedly).

1. Craft or obtain a malicious ICC profile: Use the publicly disclosed PoC file (hbo-CIccMatrixMath-SetRange-IccMatrixMath_cpp-Line379.icc) or craft a custom ICC profile with mismatched spectral range parameters designed to trigger the out-of-bounds write in CIccMatrixMath::SetRange().
2. Deliver the malicious file: Convince a local user to process the crafted ICC profile, for example by embedding it in a document, image, or color management workflow that invokes iccDEV libraries.
3. Trigger processing via iccApplyNamedCmm or similar tool: The victim runs a command such as printf "'RGB '\nicEncodeFloat\n0.5 0.5 0.5\n" | iccApplyNamedCmm /dev/stdin 3 0 malicious.icc 0, causing the library to call CIccMatrixMath::rangeMap() → SetRange() with bogus spectral range input.
4. Heap buffer overflow occurs: The SetRange() function at IccMatrixMath.cpp:379 performs a 4-byte write past the end of a heap-allocated buffer, resulting in memory corruption, application crash, or potentially controlled memory manipulation depending on heap layout (GitHub Issue #621, GitHub Advisory).

• File System: Presence of unexpected or unknown .icc profile files in user directories, temporary folders, or application data paths; specifically files with unusual spectral range metadata.
• Process: Application crashes or abnormal termination of processes that use iccDEV libraries (e.g., iccApplyNamedCmm) when processing ICC profile files; AddressSanitizer output referencing CIccMatrixMath::SetRange() at IccMatrixMath.cpp:379.
• Logs: Crash reports or core dumps from iccDEV-linked applications; error messages referencing heap-buffer-overflow in IccProfLib/IccMatrixMath.cpp (GitHub Issue #621).

The fix is available in iccDEV version 2.3.1.5, released on March 8, 2026, which adds input validation to check range and observer parameters for bogus input before performing calculations in CIccMatrixMath::SetRange(). Users should upgrade to version 2.3.1.5 or later immediately. No official workarounds are provided by the maintainers; as an interim measure, organizations should restrict local access to systems using iccDEV libraries and prevent untrusted ICC profile files from being processed (GitHub Release v2.3.1.5, GitHub PR #636, GitHub Advisory).

The vulnerability was discovered and reported by security researcher xsscx via libFuzzer-based fuzzing, with the fix contributed by ChrisCoxArt (a project contributor). The issue was triaged and resolved promptly by the iccDEV maintainers, with the patch merged within four days of the initial report and a formal release following shortly after. No significant broader media coverage or notable external researcher commentary beyond the GitHub repository activity has been identified (GitHub Issue #621, GitHub PR #636).