The vulnerability resides in a function that parses the count of array elements in ICC XML profiles. An integer overflow or underflow can occur when this function processes malformed numeric values, leading to a corrupted memory reference. The result may be an application crash (denial of service) or, if the overflow is exploited in a controlled environment, arbitrary code execution. The weakness is a classic integer handling issue. The CVE mentions the fix in a later library release, indicating the impact is tangible for applications that use the iccDEV library when processing user‑supplied ICC profiles.

Products owned by the International Color Consortium using the iccDEV library, version 2.3.1 and earlier. Users who integrate iccDEV or supply ICC color profiles to any software that relies on this library are affected. The fixed version 2.3.1.1 is available and should replace older releases.

The CVSS score of 7.8 classifies the vulnerability as high severity. While the EPSS score is below 1%, indicating a low prior probability of exploitation, the ever‑present possibility of an attacker supplying a malicious ICC profile means the risk is real for applications that ingest color profiles from untrusted sources. The vulnerability is not currently listed in the CISA KEV catalog and no public exploits are reported. Exploitation preconditions are minimal: a program that links against iccDEV and loads an ICC profile provided by an attacker. Hence the risk is moderate but warrants immediate mitigation.