CVE-2026-31796
Heap-Based Buffer Overflow in iccDEV icCurvesFromXml Causes Crash
Publication date: 2026-03-10
Last updated on: 2026-03-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| color | iccdev | to 2.3.1.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-31796 is a heap-based buffer overflow vulnerability in the icCurvesFromXml() function of the iccDEV project, which handles ICC color management profiles. The issue arises from improper validation of channel counts when parsing Color Lookup Tables (CLUTs) from XML data. This leads to out-of-bounds writes to heap-allocated buffers, causing memory corruption or crashes. The vulnerability is triggered by processing specially crafted XML data that causes the function to write beyond the allocated buffer size.
The root cause is insufficient bounds checking during XML parsing of ICC profile curve data, where the allocated buffer size does not match the amount of data written. This was discovered through fuzz testing with AddressSanitizer and fixed by updating the parsing logic to correctly validate channel counts and prevent out-of-bounds writes.
How can this vulnerability impact me? :
This vulnerability can lead to heap memory corruption or application crashes when processing maliciously crafted ICC profile XML data. An attacker with local access and the ability to provide specially crafted XML input could exploit this flaw to cause denial of service or potentially execute arbitrary code, resulting in high confidentiality, integrity, and availability losses.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by testing the iccDEV tool's handling of ICC profile XML data, specifically targeting the icCurvesFromXml() function. Fuzz testing with tools like AddressSanitizer (ASAN) has been used to identify the heap buffer overflow by feeding specially crafted XML files that trigger out-of-bounds writes."}, {'type': 'paragraph', 'content': "A practical detection method involves running the iccFromXml tool with a crafted XML input file that attempts to exploit the vulnerability. For example, using a proof-of-concept XML file similar to 'hbo-icCurvesFromXml-IccTagXml_cpp-Line333.xml' can trigger the overflow and cause the program to abort with an ASAN error report."}, {'type': 'paragraph', 'content': 'Suggested commands include running iccFromXml under AddressSanitizer to detect heap buffer overflows:'}, {'type': 'list_item', 'content': 'Compile iccDEV with AddressSanitizer enabled (if source is available):\n `clang -fsanitize=address -g -o iccFromXml IccTagXml.cpp ...`'}, {'type': 'list_item', 'content': 'Run the tool with a crafted XML file:\n `./iccFromXml hbo-icCurvesFromXml-IccTagXml_cpp-Line333.xml`'}, {'type': 'list_item', 'content': 'Observe for ASAN error reports indicating heap buffer overflow.'}] [2, 1]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the iccDEV package to version 2.3.1.5 or later, where the vulnerability in icCurvesFromXml() has been fixed by proper validation of channel counts during XML parsing.
Since exploitation requires local access and user interaction, limiting access to the vulnerable tool and avoiding processing untrusted ICC profile XML files can reduce risk.
No workarounds are provided, so updating to the fixed version is the recommended immediate action.