A heap‑buffer‑overflow occurs when the CIccXmlArrayType::ParseText() function processes an ICC color profile. The flaw allows an attacker to corrupt memory, which could lead to a crash or, in the worst case, arbitrary code execution. No explicit documentation confirms code execution, but the overflow is a classic scenario that can be exploited for that purpose.

The International Color Consortium’s iccDEV library is vulnerable. Any installation using a version earlier than 2.3.1.2 is at risk, because the patch that resolves the overflow was released in that update. Applications that load or manipulate ICC profiles via iccDEV are directly impacted.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% shows a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit the issue by supplying a crafted ICC profile to a vulnerable application, which is a local‑execution risk unless the profile can be delivered remotely. The potential impact ranges from denial of service to possible code execution depending on how the memory corruption is leveraged.