A heap-buffer-overflow exists in the CIccLocalizedUnicode::GetText() function of the InternationalColorConsortium’s iccDEV libraries. The flaw allows the contents of a heap buffer to be read or written beyond its bounds, which can corrupt program state, cause crashes, or enable arbitrary code execution depending on the attacker’s payload. The vulnerability is classified as CWE‑20 (Improper Input Validation) and CWE‑787 (Out-of-Bounds Write).

The affected product is International Color Consortium’s iccDEV, a library used for handling ICC color management profiles. Versions prior to 2.3.1.2 are vulnerable.

This vulnerability has a CVSS score of 8.8, indicating high severity, while its EPSS score is below one percent, suggesting a very low current exploitation likelihood. The issue is not listed in CISA’s KEV catalog. The flaw arises when an application parses an ICC profile through the CIccLocalizedUnicode::GetText() routine; the overflow can corrupt memory, potentially leading to arbitrary code execution or service disruption. The attack vector is likely local or remote via crafted ICC files, as the description does not specify remote network access. Mitigation requires applying the patched library.