CVE-2026-34534: 
Homebrew vulnerability analysis and mitigation

CVE-2026-34534 is a heap-based buffer overflow (HBO) vulnerability in the iccDEV library, specifically in the CIccMpeSpectralMatrix::Describe() function within IccProfLib/IccMpeSpectral.cpp. A crafted ICC color profile can trigger an out-of-bounds heap read when processed by tools such as iccDumpProfile. All iccDEV versions prior to 2.3.1.6 are affected. The vulnerability was reported on March 10, 2026, patched on March 15, 2026, and publicly disclosed via a GitHub security advisory on March 28, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, and 6.2 (Medium) per the GitHub advisory (GitHub Advisory, Red Hat).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow). The vulnerability arises from insufficient validation of input/output channel counts — including failure to reject zero input channels — in the spectral MPE read and validate paths of IccMpeSpectral.cpp. When a maliciously crafted ICC profile is parsed, CIccMpeSpectralMatrix::SetSize() allocates a 1-byte heap region, and the subsequent Describe() call at line 347 performs a 4-byte read beyond the allocated buffer boundary. The fix added stricter channel count validation in Read() and Validate() routines for spectral MPE elements, and a proof-of-concept reproducer (including the malicious .icc file and AddressSanitizer output) is publicly available in GitHub issue #665 (GitHub Issue, GitHub PR).

Successful exploitation causes a process crash via an out-of-bounds heap read, resulting in a denial of service (DoS) to any application or tool that processes the malicious ICC profile. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The attack is local and requires user interaction (e.g., a user or automated pipeline running iccDumpProfile on a crafted file), limiting the scope of impact to the affected process (GitHub Advisory).

A public proof-of-concept is available in GitHub issue #665, including the malicious ICC profile and step-by-step reproduction instructions using AddressSanitizer. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term (GitHub Issue, Feedly).

1. Obtain or craft a malicious ICC profile: Download or create a specially crafted ICC profile that encodes invalid spectral MPE channel counts (e.g., zero input channels), such as the PoC file hbo-CIccMpeSpectralMatrix-Describe-IccMpeSpectral_cpp-Line347.icc referenced in issue #665.
2. Target a vulnerable iccDEV installation: Identify a system running iccDEV version prior to 2.3.1.6 (e.g., v2.3.1.5 at commit 1ffa7a8).
3. Deliver the malicious profile: Provide the crafted .icc file to the target user or automated pipeline that processes ICC profiles (e.g., via email attachment, file share, or web upload).
4. Trigger processing: Cause the victim to run iccDumpProfile <malicious.icc> ALL or any application that invokes CIccMpeSpectralMatrix::Describe() on the profile.
5. Achieve denial of service: The out-of-bounds 4-byte heap read at IccMpeSpectral.cpp:347 triggers an AddressSanitizer abort or a process crash, resulting in denial of service (GitHub Issue, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .icc files in directories processed by iccDEV tools; specifically files with anomalous spectral MPE tag structures or unusually large file sizes (e.g., 16 MB as seen in the PoC).
• Logs: Application crash logs or core dumps referencing CIccMpeSpectralMatrix::Describe() or IccMpeSpectral.cpp:347; AddressSanitizer output containing heap-buffer-overflow in iccDEV tool processes.
• Process: Unexpected termination (abort/crash) of iccDumpProfile or other iccDEV-based tools shortly after processing an ICC profile file (GitHub Issue).

Upgrade iccDEV to version 2.3.1.6 or later, which includes the fix merged on March 15, 2026 (PR #682). The patch adds stricter validation of input/output channel counts in spectral MPE Read() and Validate() routines, rejecting zero input channels and preventing invalid allocations. No workarounds are provided by the vendor — upgrading is the only recommended remediation. Package managers such as npm (npm update iccdev), Homebrew (brew update iccdev), and Docker (docker pull ghcr.io/internationalcolorconsortium/iccdev:latest) can be used to obtain the patched version (GitHub Advisory, GitHub PR).