CVE-2026-31795: 
Homebrew vulnerability analysis and mitigation

CVE-2026-31795 is a stack-based buffer overflow vulnerability in the CIccXform3DLut::Apply() function of iccDEV, a library and toolset for working with ICC color management profiles maintained by the International Color Consortium. The vulnerability affects all iccDEV versions prior to 2.3.1.5 and was discovered and reported by security researcher xsscx on March 6, 2026, with the fix merged on March 7, 2026, and the patched release (v2.3.1.5) published on March 8, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is improper bounds checking during 3D LUT (Look-Up Table) color profile processing in IccProfLib/IccCmm.cpp at line 5873, classified under CWE-120 (Buffer Copy without Checking Size of Input), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write). Specifically, the function fails to verify that the LUT output colorspace and channel counts agree before writing to a stack-allocated buffer, resulting in a 4-byte write past the end of the XYZbp stack variable. The fix introduced by ChrisCoxArt (PR #655) adds validation to check that LUT output colorspace and channel counts agree before processing (GitHub Issue, GitHub PR). Exploitation requires local access and user interaction — specifically, a user must open or process a specially crafted malicious ICC profile file using an application that links against the vulnerable iccDEV library (GitHub Advisory).

Successful exploitation can result in stack memory corruption, application crash (denial of service), potential information disclosure through memory leakage, or arbitrary code execution depending on memory layout and how the vulnerable function is invoked. All three security pillars are rated High impact: confidentiality, integrity, and availability. The scope is limited to the affected application process (Scope: Unchanged), but arbitrary code execution could allow an attacker to pivot within the user's session or access sensitive data processed by the application (GitHub Advisory, Feedly).

There is no evidence of active in-the-wild exploitation or weaponized exploit kits at this time. A proof-of-concept (PoC) replay scenario was publicly documented in the GitHub issue by the reporter (xsscx), including a malicious ICC profile file hosted at https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/sbo-CIccXform3DLut-Apply-IccCmm_cpp-Line5873.icc and reproduction steps using iccApplyProfiles with AddressSanitizer. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Issue, Feedly).

1. Craft or obtain a malicious ICC profile: Create or download a specially crafted ICC color profile file designed to trigger the out-of-bounds write in CIccXform3DLut::Apply(). A public PoC file is available at https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/sbo-CIccXform3DLut-Apply-IccCmm_cpp-Line5873.icc.
2. Identify a target application: Locate an application on the target system that uses the vulnerable iccDEV library (versions < 2.3.1.5) for ICC color profile processing, such as image editing or color management tools.
3. Deliver the malicious profile: Convince the target user to open or process the crafted ICC profile file through the vulnerable application (e.g., via social engineering, a malicious download, or embedding in a document).
4. Trigger the overflow: When the application processes the malicious profile, CIccXform3DLut::Apply() is called, performing a 4-byte write past the end of the XYZbp stack buffer at IccCmm.cpp:5873, corrupting adjacent stack memory.
5. Achieve impact: Depending on memory layout and stack protections, the result may be an application crash (DoS), information disclosure via corrupted stack data, or — in favorable conditions — arbitrary code execution within the context of the running process (GitHub Issue, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .icc profile files in user directories or application temp folders; specifically files that trigger errors when processed by iccDEV-linked applications.
• Logs: Application crash logs or core dumps referencing CIccXform3DLut::Apply() or IccCmm.cpp:5873; AddressSanitizer output showing stack-buffer-overflow with SCARINESS: 51 (4-byte-write-stack-buffer-overflow).
• Process: Unexpected termination (crash) of image processing or color management applications after opening an ICC profile; error messages such as Error 8 - Unable to begin profile application - Possibly invalid or incompatible profiles from iccApplyProfiles or similar tools.
• Network: Downloads of .icc files from untrusted or unknown external sources, particularly from repositories or URLs not associated with legitimate ICC profile vendors (GitHub Issue).

The primary remediation is to upgrade iccDEV to version 2.3.1.5 or later, which includes the fix from PR #655 that validates LUT output colorspace and channel counts before processing. No official workarounds are provided by the maintainers. As interim measures, organizations should avoid processing ICC profiles from untrusted sources, implement file integrity checks before processing ICC profiles, and consider sandboxing applications that handle user-supplied color profiles (GitHub Advisory, iccDEV Release).

The vulnerability was noted on Mastodon via @thehackerwire shortly after disclosure, and was picked up by several CVE aggregation and threat intelligence platforms including cvefeed.io, vuldb.com, and radar.offseq.com. Community reaction has been minimal given the low EPSS score and absence of active exploitation. The fix was developed and merged rapidly (within one day of the issue being filed), reflecting responsive maintainership by the International Color Consortium team (Feedly).