CVE-2026-30987: 
Homebrew vulnerability analysis and mitigation

CVE-2026-30987 is a stack buffer overflow vulnerability in iccDEV's CIccTagNum<>::GetValues() function, located in IccProfLib/IccTagBasic.cpp at line 6098, that causes stack memory corruption or crash when processing malicious ICC color management profiles. It affects all iccDEV versions prior to 2.3.1.5 and was reported on February 24, 2026, with the fix merged on March 1, 2026, and the patched release published on March 8, 2026. The CVE was formally published on March 10, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is a classic buffer copy without size validation (CWE-120, CWE-121, CWE-787): the GetValues() function iterates based on the input buffer size rather than the output buffer size, allowing a 4-byte write past the end of a stack-allocated variable (rv at offset 32–36 in the frame). The vulnerability is triggered locally when a user or application processes a specially crafted ICC color profile — for example, by passing a malicious .icc file to the iccApplyNamedCmm tool. The call chain runs from CIccTagStruct::GetElemNumberValue() → CIccTagNum<>::GetValues(), where the out-of-bounds write occurs. A PoC .icc file and reproduction steps were publicly disclosed in the original issue report (GitHub Issue #618, GitHub Advisory).

Successful exploitation can result in stack memory corruption, application crash (denial of service), or potentially arbitrary code execution in the context of the user running the iccDEV application. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, meaning an attacker could potentially read sensitive stack data, modify program control flow, or crash the application. Because the attack vector is local and requires user interaction (opening a malicious ICC profile), the blast radius is limited to the affected workstation or server processing untrusted ICC profiles (GitHub Advisory, Feedly).

A PoC reproduction case — including a malicious .icc file and exact command-line steps — was publicly disclosed in GitHub Issue #618 on February 24, 2026, prior to the patch being released (GitHub Issue #618). However, there is no evidence of weaponized exploit kits or active in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

1. Obtain a malicious ICC profile: Download or craft a specially structured .icc file that triggers the out-of-bounds write in CIccTagNum<>::GetValues(). A public PoC file is available at https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/sbo-CIccTagStruct-GetElemNumberValue-IccTagComposite_cpp-Line737.icc.
2. Deliver the file to the target: Convince a user to open the malicious ICC profile using a vulnerable iccDEV tool (e.g., via email attachment, download, or shared network path).
3. Trigger processing via iccApplyNamedCmm: Execute the following command on a system running iccDEV < 2.3.1.5:

   printf "'RGB '\nicEncodeFloat\n0.5 0.5 0.5\n" | iccApplyNamedCmm /dev/stdin 3 0 <malicious.icc> 0

4. Achieve stack buffer overflow: The CIccTagStruct::GetElemNumberValue() function calls CIccTagNum<>::GetValues(), which writes 4 bytes past the end of the stack-allocated rv variable at IccTagBasic.cpp:6098, corrupting the stack frame.
5. Outcome: Depending on stack layout and mitigations in place, the result is an application crash (denial of service) or, in the absence of stack canaries/ASLR, potential control flow hijacking for arbitrary code execution (GitHub Issue #618, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .icc files in user download directories, temp folders, or application input directories; specifically files that trigger errors when processed by iccDEV tools.
• Process: Abnormal termination (crash/abort) of iccApplyNamedCmm or other iccDEV tools; AddressSanitizer output referencing stack-buffer-overflow in IccTagBasic.cpp:6098 or IccTagComposite.cpp:737.
• Logs: Application crash logs or core dumps from iccDEV processes; error messages such as Error 2 - Unable to begin profile application - Possibly invalid or incompatible profiles when processing untrusted ICC files.
• Network: Downloads of .icc files from untrusted or unknown external sources to systems running iccDEV (GitHub Issue #618).

Upgrade iccDEV to version 2.3.1.5 or later, which fixes the vulnerability by correcting the iteration logic in GetValues() to use the output buffer size rather than the input size (GitHub Release v2.3.1.5, GitHub PR #638). No official workarounds are provided by the maintainers. As interim mitigations, organizations should implement input validation and sandboxing for ICC profile processing, restrict processing of untrusted ICC profiles from external sources, and compile iccDEV with stack protection flags (e.g., -fstack-protector-strong) until patching is complete (GitHub Advisory).

The vulnerability was reported by researcher xsscx and fixed by ChrisCoxArt (Adobe), with the maintainer promptly triaging, reviewing, and merging the fix within days of the report. Social media activity was limited, with brief mentions on Mastodon and Bluesky shortly after disclosure. No significant mainstream media coverage or broader industry commentary has been identified (GitHub Issue #618, GitHub PR #638).