CVE-2026-34535: 
Homebrew vulnerability analysis and mitigation

CVE-2026-34535 is a heap-based buffer overflow / misaligned pointer dereference vulnerability in iccDEV, a set of libraries and tools for working with ICC color management profiles published by the International Color Consortium. A crafted ICC profile can trigger a segmentation fault (SEGV) in CIccTagArray::Cleanup() at IccTagComposite.cpp:1511, leading to a process crash when running the iccRoundTrip tool. All versions prior to 2.3.1.6 are affected. The vulnerability was reported on March 10, 2026, patched on March 15, 2026 (PR #683), and publicly disclosed via a GitHub Security Advisory on March 28, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, or 6.2 (Medium) per the GitHub advisory (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow), manifesting as misaligned member access and misaligned pointer loads in CIccTagArray::Cleanup() within IccProfLib/IccTagComposite.cpp at line 1511. When iccRoundTrip processes a maliciously crafted ICC profile, the cleanup routine attempts to dereference a tag pointer at address 0xbebebebebebebebe — a sentinel/poison value — which does not meet the required 8-byte alignment for the IccTagPtr type, triggering undefined behavior under UBSan and a fatal SEGV under ASan. The fix (PR #683) added safety checks in CIccTagArray::Cleanup() to avoid dereferencing invalid or misaligned tag pointers during cleanup, and zeroed pointers and sizes in copy constructors (GitHub Issue, GitHub PR, GitHub Advisory).

Successful exploitation results in a denial of service — the iccRoundTrip process crashes due to a segmentation fault triggered during ICC profile cleanup. There is no impact on confidentiality or integrity; only availability is affected (CVSS A:H, C:N, I:N). The scope is limited to the local process handling the malicious profile, with no evidence of lateral movement potential or data exposure (GitHub Advisory, Red Hat CVE).

A public proof-of-concept (PoC) is available in GitHub Issue #666, including a malicious ICC file download URL and exact reproduction commands using ASan/UBSan instrumentation. Exploitation requires local access and user interaction (opening a crafted ICC profile), and no privileges are required. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub Issue, Feedly).

1. Obtain the malicious ICC profile: Download the pre-crafted PoC ICC file: wget https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/segv-CIccTagArray-Cleanup-IccTagComposite_cpp-Line1511.icc
2. Build a vulnerable version of iccDEV: Clone the repository and check out a commit prior to the fix (e.g., git checkout 1ffa7a8df60c01b7ac86c5c5bdfe31cfdb7bb2c0), then compile with ASan/UBSan: export CXX=clang++ && export CXXFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g -O1" && cmake ... && make -j$(nproc)
3. Trigger the vulnerability: Run iccRoundTrip against the malicious profile: ASAN_OPTIONS=print_scariness=1:halt_on_error=0:abort_on_error=0:print_full_stacktrace=1:detect_leaks=0 iccRoundTrip segv-CIccTagArray-Cleanup-IccTagComposite_cpp-Line1511.icc
4. Observe the crash: The process crashes with a SEGV in CIccTagArray::Cleanup() at IccTagComposite.cpp:1511 due to a misaligned pointer dereference at address 0xbebebebebebebebe, causing denial of service (GitHub Issue).

• Process: Unexpected crash or termination of the iccRoundTrip process; core dump files generated in the working directory associated with iccRoundTrip.
• Logs: ASan/UBSan output containing runtime error: member access within misaligned address 0xbebebebebebebebe or SEGV on unknown address referencing CIccTagArray::Cleanup() at IccTagComposite.cpp:1511.
• File System: Presence of files named segv-CIccTagArray-Cleanup-IccTagComposite_cpp-Line1511.icc or similarly named crafted ICC profiles in directories accessible to the iccDEV tools (GitHub Issue).

Upgrade iccDEV to version 2.3.1.6 or later, which includes the fix merged in PR #683 on March 15, 2026. The fix adds safety checks in CIccTagArray::Cleanup() to prevent dereferencing invalid or misaligned tag pointers. No official workarounds are provided by the vendor; as a defensive measure, restrict ICC profile processing to trusted sources and validate or sandbox ICC profiles from untrusted origins before processing (GitHub Advisory, GitHub PR).