CVE-2026-31797: 
Homebrew vulnerability analysis and mitigation

CVE-2026-31797 is a heap out-of-bounds read vulnerability in the CTiffImg::ReadLine() function of iccDEV, a set of libraries and tools for working with ICC color management profiles maintained by the International Color Consortium. The flaw is triggered when the iccApplyProfiles tool processes a specially crafted TIFF image, potentially causing memory disclosure or application crash. All iccDEV versions prior to 2.3.1.5 are affected. The vulnerability was reported on March 8, 2026, patched on March 8, 2026, and publicly disclosed via GitHub Security Advisory GHSA-wh2p-cm3r-7hm3 on March 9, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) leading to a heap out-of-bounds read (CWE-125) and potentially out-of-bounds write (CWE-787) in CTiffImg::ReadLine() at TiffImg.cpp:370. When iccApplyProfiles opens a crafted TIFF file, the buffer allocated in CTiffImg::Open() is undersized relative to the strip data subsequently read via memcpy in ReadLine(), causing a read of 12 bytes past the end of a 24-byte heap region. The fix (PR #659) allocates the buffer using the maximum strip size to prevent the overflow. Exploitation requires local access and user interaction — specifically, a user must process a malicious TIFF file with iccApplyProfiles. A public proof-of-concept TIFF file and reproduction steps are available in the researcher's GitHub repository (GitHub Issue #656, GitHub PR #659).

Successful exploitation can result in memory disclosure — allowing an attacker to read sensitive data from heap memory — or cause the iccApplyProfiles process to crash, resulting in a denial of service. The confidentiality impact is rated Low (partial memory exposure) and availability impact is rated High (crash/abort), with no integrity impact. Because exploitation requires local access and user interaction, the attack surface is limited to scenarios where a user or automated pipeline processes untrusted TIFF files using iccDEV tools (GitHub Advisory, Feedly).

A public proof-of-concept TIFF file (hbo-CTiffImg-ReadLine-TiffImg_cpp-Line370.tiff) and reproduction steps were published by the reporter (xsscx) in the GitHub issue at the time of disclosure, making the vulnerability easily reproducible. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term (GitHub Issue #656, Feedly).

1. Obtain a crafted TIFF file: Download or craft a malicious TIFF image that triggers the heap buffer overflow in CTiffImg::ReadLine(). The public PoC file is available at https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/tif/hbo-CTiffImg-ReadLine-TiffImg_cpp-Line370.tiff.
2. Obtain a compatible ICC profile: Download a valid ICC profile such as Rec2020rgbSpectral.icc from https://github.com/xsscx/research/raw/refs/heads/main/test-profiles/Rec2020rgbSpectral.icc.
3. Invoke iccApplyProfiles: Run the vulnerable tool against the crafted TIFF: iccApplyProfiles hbo-CTiffImg-ReadLine-TiffImg_cpp-Line370.tiff output.tif 0 0 0 0 1 Rec2020rgbSpectral.icc 1
4. Trigger the overflow: The tool reads the TIFF strip data using memcpy in CTiffImg::ReadLine() at TiffImg.cpp:370, reading 12 bytes past the end of the allocated 24-byte heap buffer, causing memory disclosure or process abort.
5. Achieve objective: Depending on the runtime environment, the attacker may observe leaked heap memory contents (information disclosure) or cause the application to crash (denial of service) (GitHub Issue #656, GitHub Advisory).

• Process: Unexpected crash or abort of the iccApplyProfiles process; AddressSanitizer output referencing heap-buffer-overflow in CTiffImg::ReadLine() at TiffImg.cpp:370.
• Logs: Application logs or crash reports showing ==ERROR: AddressSanitizer: heap-buffer-overflow on address ... READ of size 12 with stack trace referencing CTiffImg::ReadLine and iccApplyProfiles.cpp:475.
• File System: Presence of unexpected or externally sourced TIFF files (e.g., files with bogus StripByteCounts fields as warned by TIFFReadDirectory: Warning, Bogus "StripByteCounts" field) in directories processed by iccDEV tools.
• Network: Downloads of TIFF files from untrusted or unknown sources to systems running iccDEV tools (GitHub Issue #656).

Upgrade iccDEV to version 2.3.1.5 or later, which fixes the vulnerability by allocating the strip buffer using the maximum strip size in CTiffImg::Open(). No official workarounds are provided by the vendor. As interim mitigations, restrict processing of TIFF images from untrusted sources using iccApplyProfiles, implement input validation for TIFF files before processing, and limit user access to the iccApplyProfiles tool where possible (GitHub Release v2.3.1.5, GitHub Advisory).

The vulnerability was discovered and reported by security researcher xsscx using libFuzzer-based fuzzing, with the fix contributed by ChrisCoxArt (a project maintainer). The issue was triaged, patched, and released within approximately 24 hours of initial report, demonstrating a responsive disclosure process. No significant broader media coverage or notable external researcher commentary beyond the GitHub issue and advisory has been observed (GitHub Issue #656, GitHub PR #659).