icdev provides libraries that handle ICC color profiles. A heap buffer overflow exists in the ToneMap parser in all releases before 2.3.1.2. When parsing an ICC profile, the overflow can corrupt memory adjacent to the buffer, potentially leading to unpredictable behavior or denial of service. The vulnerability is a classic off‑by‑one or out‑of‑bounds write, as identified by the CWEs "CWE‑122", "CWE‑193", and "CWE‑787".

All builds of iccDEV older than version 2.3.1.2 are affected. The impact applies to any application that incorporates iccDEV for color management, such as image editing suites, printing workflows, and other software that processes ICC profiles. The vendor is the International Color Consortium.

The CVSS score is 6.6, reflecting a moderate severity. EPSS is listed as less than 1%, indicating a low probability of real‑world exploitation at this time. The vulnerability is not in the CISA KEV catalog. Based on the function where the overflow occurs, the likely attack vector is local or remote via a crafted ICC file, inferred from the fact that the parser operates on file input. Because the library may be bundled in many applications, a malicious ICC profile could potentially compromise any host that loads it. The advice is to apply the patch promptly while monitoring for anomalous activity.