CVE-2026-31792: 
Homebrew vulnerability analysis and mitigation

CVE-2026-31792 is a null pointer dereference (NPD) vulnerability in the CIccTagXmlStruct::ParseTag() function of iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The vulnerability affects all iccDEV versions prior to 2.3.1.5 and was discovered and reported on March 1, 2026, with the CVE published on March 10, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is a missing null pointer check before dereferencing a child XML node pointer in CIccTagXmlStruct::ParseTag() at IccTagXml.cpp:4725, classified as CWE-476 (NULL Pointer Dereference). The GitHub security advisory also references CWE-120 (Classic Buffer Overflow), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write), suggesting the null dereference may be accompanied by memory safety issues. Exploitation requires a local attacker to supply a maliciously crafted XML-based ICC color profile file and have a user (or automated process) parse it using the iccFromXml tool or the underlying library, triggering a segmentation fault via a READ access to address 0x50 (null page). A public proof-of-concept XML file (segv-CIccTagXmlStruct-ParseTag-IccTagXml_cpp-Line4738.xml) was published by the reporter alongside the issue (GitHub Issue #633, GitHub Advisory).

Successful exploitation causes the application parsing the malicious ICC profile to crash with a segmentation fault, resulting in a denial of service. The CVSS score also reflects high confidentiality and integrity impact, consistent with the associated buffer overflow CWEs, which could theoretically allow memory corruption beyond a simple crash. The attack is local and requires user interaction (opening or processing a crafted ICC profile file), limiting the immediate blast radius, but applications that automatically process ICC profiles from untrusted sources (e.g., image editors, color management pipelines) could be affected without explicit user action (GitHub Advisory, GitHub Issue #633).

A public proof-of-concept XML file demonstrating the crash was published by the reporter (xsscx) alongside the original issue on March 1, 2026, making reproduction straightforward (GitHub Issue #633). However, there is no evidence of in-the-wild exploitation or weaponized exploit kits targeting this vulnerability. The EPSS score is extremely low at 0.000110, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Obtain the PoC payload: Download or craft a malicious XML-based ICC profile file, such as the publicly available segv-CIccTagXmlStruct-ParseTag-IccTagXml_cpp-Line4738.xml from the reporter's repository (https://github.com/xsscx/fuzz/raw/refs/heads/master/xml/icc/segv-CIccTagXmlStruct-ParseTag-IccTagXml_cpp-Line4738.xml).
2. Identify a vulnerable target: Confirm the target system is running iccDEV version prior to 2.3.1.5, using the iccFromXml tool or any application that uses the iccDEV XML parsing library.
3. Deliver the malicious file: Place the crafted ICC XML profile where it will be processed — either by directly invoking iccFromXml <malicious.xml> output.icc or by embedding it in a workflow that automatically processes ICC profiles.
4. Trigger the crash: When the application calls CIccTagXmlStruct::ParseTag(), it dereferences a null _xmlNode child pointer at IccTagXml.cpp:4725, causing a segmentation fault (SIGSEGV) and crashing the process, achieving denial of service (GitHub Issue #633, GitHub Advisory).

• Process: Unexpected crash or segmentation fault of any process invoking iccFromXml or applications linked against the iccDEV XML library; process termination with signal SIGSEGV.
• Logs: UndefinedBehaviorSanitizer or AddressSanitizer output referencing IccTagXml.cpp:4725 and CIccTagXmlStruct::ParseTag(); error messages such as SUMMARY: AddressSanitizer: SEGV IccXML/IccLibXML/IccTagXml.cpp:4725:87.
• File System: Presence of unexpected or externally sourced XML ICC profile files (.xml) in directories processed by iccDEV tools, particularly files with malformed or minimal XML structure targeting the CIccTagXmlStruct parsing path (GitHub Issue #633).

The fix is available in iccDEV version 2.3.1.5, released on March 8, 2026, which adds a null pointer check before dereferencing the children pointer in CIccTagXmlStruct::ParseTag(). No official workarounds are provided by the maintainers. As interim mitigations, organizations should implement input validation and sandboxing when processing ICC profiles from untrusted sources, and avoid exposing iccDEV-based tools to untrusted input until the patch is applied (GitHub Release v2.3.1.5, GitHub PR #639).

The vulnerability received routine coverage from automated CVE tracking services and security aggregators including CVEFeed, VulDB, and Radar/Offseq shortly after publication. Social media mentions were observed on Mastodon and Bluesky, consistent with standard low-severity CVE announcement traffic. No notable researcher commentary or significant media coverage beyond automated aggregation has been identified (Feedly).