The vulnerability is a heap buffer overflow in the iccDEV library’s CIccTagLut16::Validate() function when processing ICC color profiles. A malformed profile can corrupt heap memory, potentially allowing an attacker to execute arbitrary code or cause an application crash. The CVE description explicitly notes that the flaw is triggered during profile validation, indicating that malicious files serve as the primary exploitation vector.

All installations of the International Color Consortium’s iccDEV library built before release 2.3.1.2 are affected. Applications that depend on iccDEV for handling ICC profiles—such as image editing software, graphics libraries, and digital asset management systems—must be reviewed, as they could load untrusted profiles from external sources.

The CVSS score of 6.1 classifies the issue as medium severity. EPSS < 1% indicates a very low but nonzero chance of real‑world exploitation, and the vulnerability is not listed in CISA’s KEV catalog, meaning no widespread, known exploits exist yet. Based on the typical use of ICC profiles, the likely attack path involves an attacker delivering a malicious or corrupted ICC file into an application that uses iccDEV, causing the allocator to overflow during validation. This could undermine the confidentiality, integrity, or availability of the host, depending on how the memory corruption is leveraged.