CVE-2026-34551: 
Homebrew vulnerability analysis and mitigation

CVE-2026-34551 is a null-pointer dereference (NPD) vulnerability in the iccDEV ICC color management library, specifically in the CIccTagLut16::Write() function. It affects all iccDEV versions prior to 2.3.1.6 and can be triggered by processing a crafted ICC profile embedded in a TIFF file using the iccTiffDump tool. The vulnerability was reported on March 18, 2026, patched on March 26, 2026 (PR #728), and publicly disclosed on March 28, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, or 6.2 (Medium) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is a NULL pointer dereference (CWE-476) in CIccTagLut16::Write(CIccIO*) at IccTagLut.cpp:5361. When a crafted ICC profile containing a LUT16 tag with a curve that has zero samples is processed, CIccTagCurve::operator[] in IccTagLut.h:142 attempts to bind a reference to a null pointer of type icFloatNumber (float), causing a crash. The attack vector is local — an attacker must supply a malicious ICC profile (e.g., embedded in a TIFF) to a user or process running iccTiffDump. The fix, contributed by ChrisCoxArt in PR #728, ensures the LUT/curve write path validates required curve/table pointers and their sizes before dereferencing (GitHub Issue, GitHub Advisory, GitHub PR).

Successful exploitation results in a denial-of-service (DoS) condition — specifically, a crash of any iccDEV tool (such as iccTiffDump) that attempts to write or serialize an ICC profile containing the malformed LUT16 tag. There is no impact on confidentiality or integrity; only availability is affected. The scope is limited to the local system and the affected process, with no evidence of lateral movement potential or data exposure risk (GitHub Advisory).

A public proof-of-concept (PoC) exploit is available via the GitHub issue tracker, including a specific malicious ICC file and exact reproduction steps. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Issue, Feedly).

1. Obtain the malicious ICC file: Download the pre-crafted PoC ICC profile: wget https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/tif/npd-CIccTagLut16-Write-IccTagLut_cpp-Line5361.icc
2. Identify a vulnerable target: Confirm the target system is running iccDEV version prior to 2.3.1.6 with the iccTiffDump tool available.
3. Trigger the vulnerability: Execute iccTiffDump npd-CIccTagLut16-Write-IccTagLut_cpp-Line5361.icc foo.bar — this causes iccTiffDump to extract the embedded ICC profile and attempt to serialize it, invoking CIccTagLut16::Write().
4. Crash occurs: The tool dereferences a null pointer in CIccTagCurve::operator[] at IccTagLut.h:142 when processing a LUT16 curve with zero samples, resulting in a process crash (denial of service) (GitHub Issue, GitHub Advisory).

• Process: Unexpected crash or abnormal termination of iccTiffDump or other iccDEV tools during ICC profile processing.
• Logs: UBSan/ASan runtime error messages referencing IccTagLut.h:142 (reference binding to null pointer of type 'icFloatNumber') or IccTagLut.cpp:5361 in application logs or crash reports.
• File System: Presence of the file npd-CIccTagLut16-Write-IccTagLut_cpp-Line5361.icc or similarly named crafted ICC/TIFF files in working directories or temp folders.
• Network: Unexpected downloads of .icc files from external sources (e.g., github.com/xsscx/fuzz) by automated processing pipelines (GitHub Issue).

Upgrade iccDEV to version 2.3.1.6 or later, which includes the fix merged in PR #728 on March 26, 2026. Package managers can be used: npm update iccdev, brew update iccdev, or pulling the latest Docker image (docker pull ghcr.io/internationalcolorconsortium/iccdev:latest). No official workarounds are provided by the vendor; as interim measures, restrict processing of ICC profiles or TIFF files from untrusted sources and implement input validation before passing files to iccDEV tools (GitHub Advisory, GitHub PR).