The vulnerability is a heap‑based buffer overflow in the CIccMBB::Validate() function of iccDEV. The function validates tag data in ICC color management profiles; an attacker can supply crafted data that overflows a heap buffer, potentially leading to arbitrary code execution or memory corruption. The weakness is identified as CWE‑122, indicating an untrusted input invoked without proper bounds checking, which can compromise confidentiality, integrity, and availability of the affected system.

InternationalColorConsortium’s iccDEV library and tools are affected, specifically versions 2.3.1 and earlier. The flaw was fixed in version 2.3.1.1. Systems that rely on these libraries to process ICC profiles, especially when accepting untrusted profiles from external sources, are at risk if they have not upgraded.

The CVSS score of 8.8 classifies the issue as high severity, and the EPSS score of <1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited. However, the heap overflow allows a local or remote attacker who can influence the ICC data stream to achieve arbitrary code execution. The attack likely requires the attacker to supply malicious ICC data to a system component that loads or validates profiles.