A unicode buffer overflow in the CIccTagTextDescription component of iccDEV can corrupt memory when processing ICC color profiles. The vulnerability is identified as CWE‑122 (Unchecked Input Buffer Size), CWE‑125 (Use After End of Buffer), and CWE‑193 (Signed to Unsigned Conversion). An attacker might supply a crafted ICC profile that triggers the overflow, leading to undefined behavior and possibly arbitrary code execution or a crash. No mitigations other than patching are known.

The defect affects the iccDEV library provided by the International Color Consortium for all versions prior to 2.3.1.2. Users of this library who process ICC profiles are potentially exposed and should review the version of iccDEV installed on their systems.

The CVSS score of 6.1 indicates medium severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Intended exploitation would likely involve an application that loads untrusted ICC profiles; as such the attack surface is local to the application and typically requires the attacker to supply a malicious profile, but remote exploitation is theoretically possible if the profile data originates from a network source.