The vulnerability is a stack overflow that occurs when the XML calculator macro expansion processes malicious input. The overflow corrupts memory and can lead to application crashes. The weakness is classified under several CWEs, including buffer overflow and unchecked input.

The flaw affects the International Color Consortium's iccDEV library on any release older than version 2.3.1.2. Systems that load iccDEV to parse or manipulate ICC profiles and XML representations are at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild as of this analysis. The vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be remote, relying on an adversary's ability to supply crafted XML input to a component that uses iccDEV. If the application accepts untrusted XML from external sources, the risk escalates.