iccDEV libraries contain a Use After Free, Heap-based Buffer Overflow, Integer Overflow or Wraparound, and Out-of-bounds Write in the CIccSparseMatrix::CIccSparseMatrix function. These flaws can allow an attacker to read, modify, or execute arbitrary code, potentially leading to loss of confidentiality, integrity, and availability of data processed by affected applications. The CVSS base score of 7.8 indicates a high severity scenario based on the potential impact of arbitrary code execution or denial of service.

International Color Consortium iccDEV versions 2.3.1.1 and earlier are susceptible to this vulnerability. The flaw is specifically present in the CIccSparseMatrix implementation used by the library.

The EPSS score of less than 1% suggests a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the high CVSS rating indicates a serious risk if successfully exploited. The likely attack vector involves supplying a crafted ICC profile to an application that uses iccDEV; if the application runs with elevated permissions, the flaw could be leveraged for remote code execution. Successful exploitation would require the ability to deliver a malformed profile to the vulnerable component, which is feasible from untrusted or remote sources that can supply ICC data to the affected system.