CVE-2026-34541: 
Homebrew vulnerability analysis and mitigation

CVE-2026-34541 is a NULL Pointer Dereference vulnerability in iccDEV, a set of libraries and tools for working with ICC color management profiles published by the International Color Consortium. A crafted ICC profile can trigger Undefined Behavior (UB) via a null-pointer member call in CIccCombinedConnectionConditions::CIccCombinedConnectionConditions(), reported by UBSan as "member call on null pointer of type CIccTagSpectralViewingConditions". The vulnerability affects all iccDEV versions prior to 2.3.1.6 and was disclosed on March 31, 2026, with the fix merged on March 15, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, and 6.2 (Medium) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is a NULL Pointer Dereference (CWE-476) in IccProfLib/IccPcc.cpp at line 337, where CIccCombinedConnectionConditions::CIccCombinedConnectionConditions() performs a member call on a CIccTagSpectralViewingConditions pointer without first validating that it is non-null. The vulnerability is triggered locally when a user runs iccApplyNamedCmm with the -PCC flag and supplies a malformed .icc profile that omits or corrupts the required CIccTagSpectralViewingConditions (svcn) tag data. The fix, merged in PR #691, adds appropriate null checks in the combined connection conditions construction path before dereferencing the pointer (GitHub Issue, GitHub PR, GitHub Advisory).

Successful exploitation results in a process crash (denial of service) when iccApplyNamedCmm processes a malformed ICC profile, disrupting color profile processing workflows. There is no impact on confidentiality or integrity — the vulnerability is limited to availability (High). Because exploitation requires local access and user interaction to supply the crafted file, the scope of impact is confined to the affected process and does not enable lateral movement or data exfiltration (GitHub Advisory, Feedly Intel).

A public proof-of-concept (PoC) with concrete reproduction steps is available in GitHub Issue #676, including the specific malformed ICC profile file, input data, and iccApplyNamedCmm command that reproducibly triggers the UBSan error. The EPSS score is 0.000120 (very low probability of exploitation in the wild), and there is no evidence of active in-the-wild exploitation or inclusion in the CISA KEV catalog. No threat actor attribution has been reported (GitHub Issue, Feedly Intel).

1. Obtain the malformed ICC profile: Download or craft a malformed .icc profile that omits the required CIccTagSpectralViewingConditions (svcn) tag. The public PoC uses: wget https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/npd-CIccCombinedConnectionConditions-IccPcc_cpp-Line337.icc
2. Prepare input data: Create a PCC test data file with: printf "'RGB '\t; Data Format\nicEncodeFloat\t; Encoding\n\n0.5 0.5 0.5\n" > pcc-test-data.txt
3. Trigger the vulnerability: Run iccApplyNamedCmm with the -PCC flag, supplying the malformed profile: iccApplyNamedCmm pcc-test-data.txt 0 0 Testing/Display/Rec2020rgbSpectral.icc 0 -PCC npd-CIccCombinedConnectionConditions-IccPcc_cpp-Line337.icc
4. Observe crash: The process crashes with UBSan reporting IccProfLib/IccPcc.cpp:337:78: runtime error: member call on null pointer of type 'CIccTagSpectralViewingConditions', causing a denial of service (GitHub Issue).

• Process: Unexpected crash or abnormal termination of iccApplyNamedCmm process; UBSan/ASan runtime error output referencing IccProfLib/IccPcc.cpp:337.
• Logs: Application logs or stderr containing runtime error: member call on null pointer of type 'CIccTagSpectralViewingConditions' or SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior IccProfLib/IccPcc.cpp:337.
• File System: Presence of unexpected or externally sourced .icc profile files (particularly small, malformed profiles lacking the svcn tag) in directories used by iccApplyNamedCmm; files with ICC profile magic bytes but anomalously small size (e.g., ~832 bytes) and missing spectral viewing conditions tags (GitHub Issue).

Upgrade iccDEV to version 2.3.1.6 or later, which includes the null-pointer fix merged in PR #691 on March 15, 2026. No official workarounds are provided by the vendor. As interim mitigations, restrict access to the iccApplyNamedCmm tool to trusted users only, and validate ICC profile files for required tags (including svcn) before processing with the -PCC flag (GitHub Advisory, GitHub PR).