Stack overflow occurs in iccDEV's calculator parser when parsing ICC calculation expressions. Malicious input can corrupt the stack, potentially leading to arbitrary code execution or denial of service. The flaw stems from improper input validation and an out‑of‑bounds write, as indicated by CWE‑20 and CWE‑787.

All installations of iccDEV prior to version 2.3.1.2 are affected. The affected component is the iccDEV library that processes ICC color profiles. Enterprises that rely on iccDEV for managing ICC profiles, for instance in imaging, publishing or printing workflows, need to verify their version and upgrade if necessary.

The CVSS score of 5.5 indicates moderate risk. The EPSS probability is below 1%, suggesting exploitation is unlikely at present. The vulnerability is not listed in CISA's KEV catalog. The flaw is a local stack buffer overflow, so it requires an attacker to supply a crafted ICC profile to the parser. If the profile originates from an untrusted source, the risk escalates.