icCdev contains a bug that allows reading data outside the bounds of the buffer allocated for ICC profile tags during the LoadTag operation. This out‑of‑bounds read, coupled with use of an out‑of‑range pointer offset and insufficient input validation, can expose sensitive memory contents or cause an application crash. The vulnerability originates from the CIccProfile::LoadTag function and does not trigger any direct code execution path in the provided data. However, the potential for information disclosure or denial of service is clear.

The International Color Consortium's iccDEV libraries, versions 2.3.1.1 and earlier, are affected. The fix is available in release 2.3.1.2 of iccDEV.

CVSS score 6.1 indicates moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an application that loads an ICC profile from an untrusted source. A crafted profile could trigger the out‑of‑bounds read and potentially reveal memory content or crash the application. With no publicly documented exploit, the risk remains moderate but warrants patching.