CVE-2026-34533: 
Homebrew vulnerability analysis and mitigation

CVE-2026-34533 is an Undefined Behavior (UB) vulnerability in iccDEV, a set of libraries and tools for working with ICC color management profiles published by the International Color Consortium. A crafted ICC profile can trigger UB in CIccCalculatorFunc::ApplySequence() due to invalid enum values being loaded for icChannelFuncSignature, resulting in a type/enum value confusion scenario during ICC profile processing. The vulnerability affects all iccDEV versions prior to 2.3.1.6 and was reported on March 10, 2026, with a fix merged on March 15, 2026, and the security advisory published March 28, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, or 6.2 (Medium) per the GitHub security advisory (GitHub Advisory, Red Hat).

The root cause is classified as CWE-758 (Reliance on Undefined, Unspecified, or Implementation-Defined Behavior). The vulnerable code resides in IccProfLib/IccMpeCalc.h (enum icChannelFuncSignature) and is triggered at IccMpeCalc.cpp:3482 within CIccCalculatorFunc::ApplySequence(), where an invalid enum value (e.g., 3242144228) is loaded from a crafted ICC profile without proper range validation. Under UBSan, this manifests as: runtime error: load of value 3242144228, which is not a valid value for type 'icChannelFuncSignature'. The fix involved giving icChannelFuncSignature a defined 32-bit underlying type and adding sentinel range values to enforce safe validation (GitHub Issue #664, GitHub PR #681).

Successful exploitation results in a denial of service — a crafted ICC profile can crash the application or process that invokes iccDEV's ICC profile processing routines. There is no impact on confidentiality or integrity; the vulnerability is limited to availability. Any application or pipeline that processes untrusted ICC profiles using a vulnerable version of iccDEV is at risk (GitHub Advisory).

A proof-of-concept (PoC) is publicly available via GitHub Issue #664, which includes a complete reproduction sequence with specific git commands, compilation flags, a downloadable malicious ICC file, and the exact command to trigger the UB (GitHub Issue #664). There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. Exploitation requires local access and user interaction (opening a malicious ICC profile), limiting the practical attack surface.

1. Obtain the malicious ICC profile: Download the crafted ICC file from the public PoC repository: wget https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/ub-runtime-error-type-confusion-icChannelFuncSignature-IccMpeCalc_cpp-Line3482.icc
2. Build a vulnerable version of iccDEV: Clone the repository and check out a vulnerable commit (e.g., 1ffa7a8, tagged v2.3.1.5), then compile with sanitizers enabled: export CXX=clang++ && export CXXFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g -O1" && export LDFLAGS="-fsanitize=address,undefined" && cmake Cmake -DCMAKE_BUILD_TYPE=Debug -DENABLE_ASAN=ON -DENABLE_UBSAN=ON && make -j$(nproc)
3. Trigger the vulnerability: Run the iccRoundTrip tool against the crafted ICC file: iccRoundTrip ub-runtime-error-type-confusion-icChannelFuncSignature-IccMpeCalc_cpp-Line3482.icc
4. Observe the crash: UBSan reports IccMpeCalc.cpp:3482:7: runtime error: load of value 3242144228, which is not a valid value for type 'icChannelFuncSignature', and the process crashes, demonstrating denial of service (GitHub Issue #664).

• File System: Presence of unexpected .icc files in directories processed by iccDEV, particularly files with unusual sizes or structures that do not conform to standard ICC profile formats.
• Logs: Application crash logs or core dumps referencing IccMpeCalc.cpp:3482 or CIccCalculatorFunc::ApplySequence(); UBSan output containing load of value ... not a valid value for type 'icChannelFuncSignature'.
• Process: Unexpected termination or crash of processes invoking iccDEV ICC profile processing routines when handling externally supplied .icc files.

Upgrade iccDEV to version 2.3.1.6 or later, which defines the underlying type for icChannelFuncSignature and adds sentinel range values to prevent the UB (GitHub Advisory, GitHub PR #681). No official workarounds are provided by the vendor. As a defense-in-depth measure, restrict processing of ICC profiles to trusted sources only, and consider sandboxing ICC profile processing operations to limit the blast radius of any future UB issues.