CVE-2026-31793: 
Homebrew vulnerability analysis and mitigation

CVE-2026-31793 is a segmentation fault vulnerability in iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The flaw exists in the CIccCalculatorFunc::ApplySequence() function and can be triggered by a maliciously crafted ICC profile file, resulting in denial of service. All versions prior to 2.3.1.5 are affected. The vulnerability was reported on March 4, 2026, the fix was merged on March 7, 2026, and the advisory was published on March 10, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is an out-of-bounds read (CWE-125) combined with improper handling of exceptional conditions (CWE-703) and improper input validation (CWE-20) in CIccCalculatorFunc::ApplySequence() at IccProfLib/IccMpeCalc.cpp:3711. When processing a malformed ICC profile, the function performs an invalid/wild pointer read due to insufficient validation of data sizes against the number of operations, causing a segmentation fault. The fix (PR #652) adds bounds checks before adding to avoid overflow and a defensive check to catch overflow conditions. The vulnerability was discovered via libFuzzer-based fuzzing and confirmed with AddressSanitizer, which reported a SEGV on unknown address caused by a wild-addr-read (GitHub Issue, GitHub PR).

Successful exploitation causes a segmentation fault that crashes any application using the vulnerable iccDEV library when processing a malicious ICC profile, resulting in a denial of service with high availability impact. There is no confidentiality or integrity impact — the vulnerability cannot be used to read sensitive data or modify system state. Because exploitation requires local access and user interaction (a user must open or process the malicious file), the attack surface is limited to scenarios where untrusted ICC profile files can be delivered to a user (GitHub Advisory).

No public proof-of-concept exploit code is known to exist beyond the fuzzer-generated test case documented in the original issue report, and there is no evidence of in-the-wild exploitation. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and user interaction, further limiting practical risk (GitHub Issue, Feedly).

1. Craft malicious ICC profile: Create or obtain a specially crafted ICC profile file (.icc) that triggers the out-of-bounds read in CIccCalculatorFunc::ApplySequence(). The original PoC file (hbo-CIccCalculatorFunc-ApplySequence-IccMpeCalc_cpp-Line3715.icc) is referenced in the issue report and was generated via libFuzzer.
2. Deliver the file: Deliver the malicious ICC profile to a target user via email attachment, file share, or any other mechanism that results in the file being processed by an application using the vulnerable iccDEV library.
3. Trigger processing: Induce the user to open or process the malicious ICC profile — for example, by passing it as an argument to iccApplyProfiles: iccApplyProfiles foo.tif bar.tif 0 0 0 0 0 malicious.icc 1.
4. Achieve denial of service: The application crashes with a segmentation fault (SEGV on unknown address) in CIccCalculatorFunc::ApplySequence() at IccMpeCalc.cpp:3711, causing denial of service for the affected application (GitHub Issue).

• File System: Presence of unexpected or externally sourced .icc profile files in user directories or application input folders, particularly files with malformed or oversized calculator function sequences.
• Logs: Application crash logs or core dumps referencing CIccCalculatorFunc::ApplySequence() in IccProfLib/IccMpeCalc.cpp around line 3711; AddressSanitizer output showing SEGV on unknown address with a wild-addr-read scariness indicator.
• Process: Abnormal termination (segmentation fault / signal 11) of applications that process ICC profiles, such as iccApplyProfiles or any application linking against the iccDEV library (GitHub Issue).

The vendor has released iccDEV version 2.3.1.5, which includes the fix for this vulnerability. Users should upgrade to v2.3.1.5 or later immediately. No official workarounds are provided; however, as an interim measure, organizations should restrict user ability to open ICC profile files from untrusted sources and validate ICC profile files before processing them through applications using iccDEV (GitHub Advisory, Release v2.3.1.5).