Technical impact
The vulnerability resides in iccDEV's CIccTagText::Read function, where an attacker can supply overly large or malformed text data that causes an out-of-bounds read, an improper null termination, and ultimately a heap-based buffer overflow. This memory corruption can allow an attacker to manipulate the execution flow of the process using iccDEV libraries, potentially leading to arbitrary code execution or denial of service. The weakness is typical of untrusted data handling failures, as documented by the referenced CWEs.
Affected Systems
Affected versions are all releases of International Color Consortium's iccDEV 2.3.1.1 and earlier. The fix was introduced in 2.3.1.2. All installations using the vulnerable libraries or tools should be evaluated for upgrade eligibility.
Risk and Exploitability
The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the presence of untrusted or malformed ICC profile data processed by the CIccTagText::Read routine, which is likely to be supplied from external sources such as client uploads or network inputs. Given the lack of publicly available exploits and the low EPSS, the immediate risk is moderate but should be mitigated promptly.
