CVE-2026-30985
Heap-Based Buffer Overflow in iccDEV CIccMatrixMath Causes Crash
Publication date: 2026-03-10
Last updated on: 2026-03-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| color | iccdev | to 2.3.1.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-30985 is a heap-based buffer overflow vulnerability in the iccDEV project's function CIccMatrixMath::SetRange(). This function improperly handles input parameters when processing ICC color management profiles, leading to a 4-byte write that exceeds the allocated heap buffer boundaries."}, {'type': 'paragraph', 'content': 'The overflow occurs because the function copies data without verifying that the input size fits within the output buffer, causing memory corruption. This can result in crashes or potentially allow an attacker to execute arbitrary code when processing specially crafted ICC profiles.'}, {'type': 'paragraph', 'content': 'The vulnerability was identified in the source file IccMatrixMath.cpp at line 379 and affects versions prior to 2.3.1.5, where it has been fixed by validating input ranges to prevent invalid data from causing the overflow.'}] [1, 2, 4]
How can this vulnerability impact me? :
This vulnerability can lead to memory corruption, causing application crashes or instability when processing ICC profiles.
Because the buffer overflow occurs on the heap, it may also allow an attacker to execute arbitrary code or escalate privileges on the affected system if exploited successfully.
The attack requires local access and user interaction, but no special privileges are needed, making it a significant risk for users processing untrusted or malicious ICC profile data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for crashes or memory corruption events when processing ICC profiles using the iccDEV tools, especially the iccApplyNamedCmm tool.'}, {'type': 'paragraph', 'content': 'Using AddressSanitizer (ASan) during testing or runtime can help detect the heap-buffer-overflow by reporting invalid memory writes related to CIccMatrixMath::SetRange().'}, {'type': 'paragraph', 'content': "A proof-of-concept (PoC) ICC file named 'hbo-CIccMatrixMath-SetRange-IccMatrixMath_cpp-Line379.icc' can be used with iccApplyNamedCmm to reproduce the crash and confirm the presence of the vulnerability."}, {'type': 'paragraph', 'content': 'Suggested command example to test for the vulnerability using the PoC file:'}, {'type': 'list_item', 'content': 'iccApplyNamedCmm -i hbo-CIccMatrixMath-SetRange-IccMatrixMath_cpp-Line379.icc -o output_file input_file'}, {'type': 'paragraph', 'content': 'Running iccDEV tools with AddressSanitizer enabled will report the invalid write if the vulnerability is triggered.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the iccDEV package to version 2.3.1.5 or later, where the vulnerability has been fixed.
The fix involves validating input parameters in the CIccMatrixMath::SetRange() function to prevent out-of-bounds writes.
If upgrading immediately is not possible, avoid processing untrusted or malicious ICC profiles with vulnerable versions of iccDEV to reduce risk.
Monitor for updates and patches from the International Color Consortium and apply them promptly.