CVE-2026-31794: 
Homebrew vulnerability analysis and mitigation

CVE-2026-31794 is a segmentation fault vulnerability in iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The flaw exists in the CIccCLUT::Interp3d() function and is triggered by an invalid or wild pointer read, resulting in a denial of service. All iccDEV versions prior to 2.3.1.5 are affected. The vulnerability was reported on March 6, 2026, patched on March 7, 2026, and publicly disclosed via a GitHub Security Advisory on March 9, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is an out-of-bounds read (CWE-125) combined with improper handling of exceptional conditions (CWE-703) and improper input validation (CWE-20) in CIccCLUT::Interp3d() at IccProfLib/IccTagLut.cpp:2741. When processing a maliciously crafted ICC color profile file, the function dereferences an invalid or wild pointer without first clipping or validating the pointer value, causing a segmentation fault. The fix, implemented in PR #653, clips values before dereferencing the pointer. Exploitation requires local access and user interaction — specifically, a user must open or process a crafted .icc profile file using an affected iccDEV tool such as iccApplyProfiles (GitHub Issue, GitHub PR, GitHub Advisory).

Successful exploitation causes a segmentation fault that crashes the affected application, resulting in a denial of service condition. There is no impact to data confidentiality or integrity — the vulnerability exclusively affects availability. The scope is limited to the local system and the process handling the malicious ICC profile, with no potential for lateral movement or data exfiltration (GitHub Advisory, Feedly).

A public proof-of-concept (PoC) exists in the form of a crafted ICC profile file (segv-CIccCLUT-Interp3d-IccTagLut_cpp-Line2741.icc) published by the reporter (xsscx) on GitHub, which was used to reproduce the crash during maintainer review. There is no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Issue, Feedly).

1. Craft or obtain a malicious ICC profile: Obtain or create a specially crafted .icc color profile file designed to trigger an invalid pointer read in CIccCLUT::Interp3d(). A public PoC file (segv-CIccCLUT-Interp3d-IccTagLut_cpp-Line2741.icc) is available at https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/segv-CIccCLUT-Interp3d-IccTagLut_cpp-Line2741.icc.
2. Deliver the file to the target: Social-engineer or otherwise cause a local user to process the malicious ICC profile, for example by placing it in a directory where it will be used by an image processing workflow.
3. Trigger processing: The victim runs an iccDEV tool (e.g., iccApplyProfiles) referencing the malicious profile: iccApplyProfiles foo.tif /tmp/out.tif 0 0 0 0 0 malicious.icc 0.
4. Achieve denial of service: The application crashes with a segmentation fault (SEGV) due to the wild pointer read in CIccCLUT::Interp3d() at IccTagLut.cpp:2741, causing the process to abort (GitHub Issue).

• File System: Presence of unexpected or externally sourced .icc profile files in directories used by iccDEV tools; specifically files that trigger crashes when processed.
• Process: Abnormal termination (SIGBUS/SIGSEGV) of iccDEV tools such as iccApplyProfiles; core dump files generated in the working directory.
• Logs: AddressSanitizer output referencing SEGV on unknown address in CIccCLUT::Interp3d(float*, float const*) const IccProfLib/IccTagLut.cpp:2741; application crash logs with SCARINESS: 20 (wild-addr-read) (GitHub Issue).

Upgrade iccDEV to version 2.3.1.5 or later, which clips pointer values before dereferencing in CIccCLUT::Interp3d(), resolving the vulnerability. The fix was merged on March 7, 2026 (PR #653) and released as v2.3.1.5 on March 8, 2026. No workarounds are provided by the vendor; upgrading is the only recommended remediation (GitHub Release, GitHub Advisory).