iccDEV contains a heap buffer overflow in the CIccTagLut8::Validate() routine. If an attacker supplies a malicious ICC profile, the overflow can corrupt adjacent memory and may lead to arbitrary code execution or denial of service. The flaw is a classic buffer overrun, affecting confidentiality, integrity, and availability of systems that process ICC profiles through this library.

International Color Consortium’s iccDEV library, versions prior to 2.3.1.2. The patch was released in version 2.3.1.2, fully addressing the overflow. Applications that depend on iccDEV for color management are affected.

The CVSS score of 6.1 indicates moderate severity. EPSS is below 1%, suggesting that exploitation is unlikely at present, and the flaw is not listed in CISA’s KEV catalog. Attackers would need to supply a crafted ICC profile to a vulnerable application; while this can be achieved locally or remotely if the application accepts user‑supplied profiles, the lack of a known public exploit remains a mitigated risk.