CVE-2026-30986: 
Homebrew vulnerability analysis and mitigation

CVE-2026-30986 is a heap-based buffer overflow vulnerability in the CIccMatrixMath::SetRange() function of iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The vulnerability affects all iccDEV versions prior to 2.3.1.5 and can cause memory corruption or application crash when processing a maliciously crafted ICC profile file. It was reported on February 24, 2026, patched via PR #637 merged on March 1, 2026, and publicly disclosed on March 9–10, 2026. The CVSS v3.1 base score is 5.5 (Medium) (GitHub Advisory).

The root cause is an out-of-bounds write (CWE-787, estimated) in CIccMatrixMath::SetRange(), with the advisory also citing CWE-125 (Out-of-bounds Read) and CWE-476 (NULL Pointer Dereference) as associated weaknesses (GitHub Advisory). The vulnerability manifests during interpolation in CIccCLUT::Interp3d() at IccTagLut.cpp:2721, where a negative value is cast to an unsigned integer, producing undefined behavior and a wild-address read that triggers a segmentation fault (GitHub Issue #620). Exploitation requires a local attack vector and user interaction — specifically, a user must open or process a crafted ICC profile file. The fix, contributed by ChrisCoxArt in PR #637, clamps negative values to zero before interpolation and clarifies the UnitClip function pointer usage (GitHub PR #637).

Successful exploitation results in a denial-of-service condition through application crash due to heap memory corruption. The impact is limited to availability — there is no confidentiality or integrity impact, and the vulnerability does not enable code execution or data exfiltration based on current analysis. The affected scope is unchanged, meaning the crash is confined to the vulnerable iccDEV process without lateral movement potential (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction (opening a malicious ICC profile), which significantly limits the attack surface (GitHub Advisory).

1. Craft a malicious ICC profile: Create or obtain a specially crafted ICC color profile file (.icc) that triggers invalid negative index values during CLUT interpolation in CIccCLUT::Interp3d(). A sample crash-triggering file was demonstrated using npd-CIccMpeCalculator-GetNewApply-IccMpeCalc_cpp-Line4929.icc (GitHub Issue #620).
2. Deliver the file to the target: Social-engineer or otherwise cause a user on a system running a vulnerable iccDEV version (< 2.3.1.5) to open or process the malicious ICC profile.
3. Trigger the vulnerable code path: The file is processed by an iccDEV tool such as iccApplyNamedCmm or iccRoundTrip, which invokes the vulnerable CIccMatrixMath::SetRange() / CIccCLUT::Interp3d() code path. Example command: printf "'RGB '\nicEncodeFloat\n0.5 0.5 0.5\n" | iccApplyNamedCmm /dev/stdin 3 0 malicious.icc 0
4. Achieve denial of service: The undefined behavior from casting a negative value to unsigned int causes a wild-address read at IccTagLut.cpp:2721, resulting in a SIGSEGV and application crash (GitHub Issue #620).

• Process: Unexpected crash or segmentation fault (SIGSEGV) in iccDEV tools such as iccApplyNamedCmm, iccRoundTrip, or any application linking against IccProfLib, particularly with stack traces referencing CIccCLUT::Interp3d() at IccTagLut.cpp:2721.
• Logs: AddressSanitizer or UndefinedBehaviorSanitizer output containing SUMMARY: AddressSanitizer: SEGV IccProfLib/IccTagLut.cpp:2721:10 in CIccCLUT::Interp3d(float*, float const*) const or UndefinedBehaviorSanitizer: undefined-behavior IccProfLib/IccTagLut.cpp:2682:39.
• File System: Presence of unexpected or externally sourced .icc profile files in directories processed by iccDEV tools; crash dump files generated by the OS following abnormal process termination (GitHub Issue #620).

Upgrade iccDEV to version 2.3.1.5 or later, which contains the fix merged via PR #637 on March 1, 2026, and released on March 8, 2026 (iccDEV Release v2.3.1.5). No official workarounds are provided by the maintainers. As an interim measure, organizations should restrict local access to systems running vulnerable iccDEV versions and advise users against opening ICC profile files from untrusted sources (GitHub Advisory).

The vulnerability was discovered and reported by security researcher xsscx using libFuzzer-based fuzzing, with the fix developed by contributor ChrisCoxArt (GitHub PR #637). The issue was triaged and patched promptly by the iccDEV maintainers within approximately one week of initial report. No broader media coverage or notable community commentary beyond the GitHub repository has been identified.