ANT-2026-1FT5E1XF: Stack-buffer-overflow in cmslut.c:1373

When creating a color transform that takes the BlackPreservingKPlaneIntents path, BlackPreservingSampler in cmscnvrt.c allocates a fixed 16-byte (4-float) stack array 'Outf' and passes it to cmsPipelineEvalFloat/_LUTevalFloat. _LUTevalFloat at cmslut.c:1373 memcpy's output based on the pipeline's declared output-channel count, which is derived from the attacker-supplied ICC profile and can reach 15 channels (60 bytes). The resulting 60-byte write overruns 'Outf' and corrupts adjacent stack objects and redzones. An attacker who can supply an ICC profile processed with a black-preserving intent can overwrite stack memory, potentially leading to control-flow hijack.

Target

Project: lcms
Location: cmslut.c:1373

Technical Details

ASAN: "WRITE of size 60 at 0x73d5a3bda750 ... stack-buffer-overflow ... in _LUTevalFloat /src/lcms/src/cmslut.c:1373". The destination is the 16-byte 'Outf' array ([64,80) in the frame) in BlackPreservingSampler, but the memcpy length is computed from the LUT/pipeline output-channel count taken from the profile rather than the caller's buffer size, so a profile declaring many output channels overflows the fixed 4-float stack buffer.

Crash trace (truncated — full trace in attached crash.log):

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 4161537645
INFO: Loaded 1 modules   (8027 inline 8-bit counters): 8027 [0x5afb2e537230, 0x5afb2e53918b), 
INFO: Loaded 1 PC tables (8027 PCs): 8027 [0x5afb2e539190,0x5afb2e558740), 
/out/cms_transform_all_fuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1


=== ASAN Report ===
=================================================================
==27==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x73d5a3bda750 at pc 0x5afb2e3ca54e bp 0x7ffef9234050 sp 0x7ffef9233810
WRITE of size 60 at 0x73d5a3bda750 thread T0
    #0 0x5afb2e3ca54d in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3
    #1 0x5afb2e4a4b57 in _LUTevalFloat /src/lcms/src/cmslut.c:1373:5
    #2 0x5afb2e47acb3 in BlackPreservingSampler /src/lcms/src/cmscnvrt.c:895:5
    #3 0x5afb2e4a0f26 in cmsStageSampleCLut16bit /src/lcms/src/cmslut.c:796:14
    #4 0x5afb2e47a485 in BlackPreservingKPlaneIntents /src/lcms/src/cmscnvrt.c:1069:5
    #5 0x5afb2e43af73 in cmsCreateExtendedTransform /src/lcms/src/cmsxform.c:1195:11
    #6 0x5afb2e43d9e0 in cmsCreateMultiprofileTransformTHR /src/lcms/src/cmsxform.c:1311:12
    #7 0x5afb2e43d9e0 in cmsCreateTransformTHR /src/lcms/src/cmsxform.c:1352:12
    [... 10 more frames — full trace in crash.log]

Reproduction

1. Craft an ICC profile whose pipeline advertises a large output-channel count (e.g., 15)
2. Arrange for the profile/intent combination to select the BlackPreservingKPlaneIntents code path
3. Deliver the profile to the target (embedded in an image or as a standalone .icc) so cmsCreateTransform is invoked
4. During CLUT sampling, BlackPreservingSampler calls _LUTevalFloat which memcpy's 60 bytes into the 16-byte 'Outf' stack array, smashing adjacent stack memory

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-1FT5E1XF.

Reference: ANT-2026-1FT5E1XF
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure