CVE-2026-31796: 
Homebrew vulnerability analysis and mitigation

CVE-2026-31796 is a heap-based buffer overflow vulnerability in the icCurvesFromXml() function of iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The vulnerability affects all iccDEV versions prior to 2.3.1.5 and was reported on March 7, 2026, with a fix merged on March 8, 2026, and the patched release published shortly after. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) when parsing XML-based ICC color profile data, leading to a heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) in icCurvesFromXml() at IccTagXml.cpp:3330. Specifically, the function fails to validate channel counts when reading Color Lookup Tables (CLUTs) from XML, allowing a write of 8 bytes past the end of a 16-byte heap-allocated region. The fix, introduced in PR #658, adds proper channel count validation before processing CLUT data. A public proof-of-concept XML file and reproduction steps were provided in the original issue report, demonstrating the overflow via AddressSanitizer output (GitHub Issue #651, GitHub PR #658).

Successful exploitation results in heap memory corruption that can lead to application crashes (denial of service) or, in more severe scenarios, arbitrary code execution on the affected system. The vulnerability has high impact across confidentiality, integrity, and availability, as a compromised ICC profile parser could expose sensitive data, allow unauthorized data modification, or destabilize the host application. Exploitation requires local access and user interaction — specifically, a victim must open or process a crafted malicious XML ICC profile file (GitHub Advisory, Feedly).

A public proof-of-concept XML file (hbo-icCurvesFromXml-IccTagXml_cpp-Line333.xml) is available in a public repository and was used to reproduce the vulnerability during the original disclosure and patch review (GitHub Issue #651). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term (Feedly).

1. Craft or obtain a malicious XML ICC profile: Use the publicly available PoC file (hbo-icCurvesFromXml-IccTagXml_cpp-Line333.xml) from https://github.com/xsscx/fuzz/raw/refs/heads/master/xml/icc/hbo-icCurvesFromXml-IccTagXml_cpp-Line333.xml, or craft a custom XML ICC profile with malformed CLUT channel count data targeting the lutAtoBType tag structure.
2. Deliver the malicious file: Social-engineer a target user into opening the crafted XML ICC profile file using an application that relies on the vulnerable iccDEV library (e.g., iccFromXml).
3. Trigger the vulnerable code path: When the application parses the file, execution flows through CIccProfileXml::LoadXml() → CIccProfileXml::ParseXml() → CIccTagXmlLutAtoB::ParseXml() → icMBBFromXml() → icCurvesFromXml() at IccTagXml.cpp:3330.
4. Heap buffer overflow occurs: The function writes 8 bytes past the end of a 16-byte heap-allocated region, causing heap memory corruption. Depending on heap layout and exploitation technique, this may result in a crash (DoS) or potentially arbitrary code execution (GitHub Issue #651, GitHub PR #658).

• File System: Presence of unexpected or externally sourced XML ICC profile files (.xml) with lutAtoBType tags containing anomalous CLUT channel count values; PoC file named hbo-icCurvesFromXml-IccTagXml_cpp-Line333.xml.
• Process: Application crashes or abnormal termination of processes using iccDEV libraries (e.g., iccFromXml) when processing XML ICC profile files; AddressSanitizer output referencing icCurvesFromXml at IccTagXml.cpp:3330 in debug builds.
• Logs: Crash dumps or core files generated by ICC profile processing applications; error messages such as Unable to Parse 'lutAtoBType' (AToB0Tag) Tag in application logs (GitHub Issue #651).

Upgrade iccDEV to version 2.3.1.5 or later, which includes the fix that adds proper channel count validation when reading CLUTs from XML (GitHub Release v2.3.1.5). No official workarounds are provided by the maintainers. As interim measures, restrict processing of ICC profile XML files to trusted sources only, and avoid opening XML ICC profiles from untrusted or unknown origins until patching is complete (GitHub Advisory).

The vulnerability was reported by security researcher xsscx and remediated by contributor ChrisCoxArt within approximately 24 hours of the initial issue report, demonstrating a responsive disclosure and patch cycle by the iccDEV maintainers (GitHub PR #658). The issue was picked up by automated vulnerability tracking feeds and aggregators shortly after disclosure, but no significant broader media coverage or notable researcher commentary beyond the GitHub discussion has been identified.