CVE-2026-34556: 
Homebrew vulnerability analysis and mitigation

CVE-2026-34556 is a heap-buffer-overflow (HBO) vulnerability in the icAnsiToUtf8() function within iccDEV's XML conversion path. It affects iccDEV versions prior to 2.3.1.6 and is triggered by processing a crafted ICC color profile file. The vulnerability was reported on March 27, 2026, patched on March 27, 2026 (PR #740), and publicly disclosed on March 31, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, and 6.2 (Medium) per the GitHub Security Advisory (GitHub Advisory, Red Hat).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-170 (Improper Null Termination). In CIccTagColorantTable::Read(), the icColorantTableEntry.name field — a fixed 32-byte icInt8Number array — is populated via Read8() without enforcing null termination. When icAnsiToUtf8(std::string&, char const*) (at IccUtilXml.cpp:394) subsequently calls strlen() on this unterminated buffer, it reads past the heap allocation boundary. AddressSanitizer reports an out-of-bounds READ of size 115 past a 114-byte heap allocation; the overread is triggered when nCount * sizeof(icColorantTableEntry) aligns to an 8-byte boundary (e.g., nCount=4, 4×38=152 bytes) with no accidental zero padding bytes after the allocation. The same crash is also reachable via CIccTagColorantTable::Describe() → IccTagBasic.cpp:8953. A public reproducer ICC file and reproduction steps are available (GitHub Issue #734, GitHub Advisory).

Successful exploitation results in a denial of service (application crash) when a user processes a maliciously crafted ICC profile using tools such as iccToXml or iccDumpProfile. The vulnerability has no confidentiality or integrity impact — it is a read-only out-of-bounds access with no write primitive — and is limited in scope to the affected process. There is no evidence of lateral movement potential or sensitive data exposure beyond the crash itself (GitHub Advisory, GitHub Issue #734).

A public proof-of-concept (PoC) is available via a crafted ICC file hosted on GitHub, with concrete reproduction steps documented in issue #734. Exploitation requires local access and user interaction (opening a malicious ICC file), limiting the attack surface. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term (GitHub Issue #734, Feedly).

1. Obtain the malicious ICC file: Download the crafted ICC profile that triggers the heap-buffer-overflow:

   wget https://github.com/xsscx/fuzz/raw/refs/heads/master/graphics/icc/hbo-icAnsiToUtf8-clrt-multitag-IccUtilXml_cpp-Line394.icc

2. Identify a vulnerable target: Confirm the target system is running iccDEV version prior to 2.3.1.6 with the iccToXml or iccDumpProfile tool available.
3. Trigger the crash via iccToXml: Execute the tool against the crafted ICC file:

   ASAN_OPTIONS=halt_on_error=1,detect_leaks=0 iccToXml hbo-icAnsiToUtf8-clrt-multitag-IccUtilXml_cpp-Line394.icc /dev/null

4. Alternatively trigger via iccDumpProfile:

   ASAN_OPTIONS=halt_on_error=1,detect_leaks=0 iccDumpProfile hbo-icAnsiToUtf8-clrt-multitag-IccUtilXml_cpp-Line394.icc ALL

5. Observe the crash: AddressSanitizer (or the OS) reports a heap-buffer-overflow at icAnsiToUtf8() in IccUtilXml.cpp:394, causing the application to crash with a denial-of-service condition (GitHub Issue #734, GitHub Advisory).

• File System: Presence of crafted ICC files with unusual or malformed colorant table tags (e.g., clrt multi-tag structures with non-null-terminated name fields); unexpected ICC files in temporary or download directories.
• Process: Abnormal termination (crash/segfault) of iccToXml or iccDumpProfile processes when processing ICC files; AddressSanitizer output referencing icAnsiToUtf8() at IccUtilXml.cpp:394 or CIccTagColorantTable::Describe() at IccTagBasic.cpp:8953.
• Logs: Application crash logs or core dumps associated with iccToXml or iccDumpProfile binaries; ASan error output containing heap-buffer-overflow, READ of size 115, and stack frames referencing strlen, std::basic_string::assign, and icAnsiToUtf8 (GitHub Issue #734).

Update iccDEV to version 2.3.1.6 or later, which includes the fix merged via PR #740 on March 27, 2026. The fix enforces null termination after Read8() in CIccTagColorantTable::Read() (colorant.name[31] = '\0') and adds a defense-in-depth bound in icAnsiToUtf8() using strnlen(szSrc, 256). No official workaround is provided for unpatched versions; as an interim measure, avoid processing ICC profile files from untrusted sources, and implement sandboxing or file validation for any automated ICC profile processing workflows (GitHub Advisory, GitHub PR #740).