The vulnerability exists in iccDEV’s CIccCalculatorFunc::SequenceNeedTempReset function, allowing an out‑of‑bounds read and an integer underflow. This flaw can expose arbitrary data in memory to the attacker, potentially leaking sensitive information. The weakness is identified as CWE‑125 and CWE‑191 and carries a CVSS score of 6.1, indicating medium severity.

InternationalColorConsortium’s iccDEV library and tools are affected, specifically versions 2.3.1.1 and earlier. The vulnerability is patched in version 2.3.1.2 and later releases.

The attack is likely executed locally through the SequenceNeedTempReset function, yet the exact attack vector is not documented, so this inference is made based on the function’s exposure to user‑supplied data. Exploitation would require the attacker to have the ability to trigger the function, and while the EPSS score is below 1%, the flaw is not listed in CISA’s KEV catalog. The medium CVSS score combined with low exploitation probability suggests a moderate risk, but organizations should not ignore it because of the potential to reveal confidential application memory.