A type confusion flaw in the iccDEV library’s SIccCalcOp::ArgsPushed() routine can corrupt memory and lead to arbitrary code execution when the library processes a specially crafted ICC color profile. The vulnerability is rooted in improper type handling (CWE‑190, CWE‑20, CWE‑476, CWE‑681) and is listed with a CVSS score of 8.8, indicating a high likelihood of causing significant damage if exploited. The impact would include loss of confidentiality, integrity, and availability of any process that loads untrusted profiles, potentially allowing an attacker to execute code with the privileges of the calling process.

InternationalColorConsortium’s iccDEV library version 2.3.1.2 or newer is unaffected. All earlier releases, particularly 2.3.1.1 and earlier, are vulnerable and may be present in systems that rely on iccDEV to load or edit ICC profiles.

The vulnerability’s CVSS of 8.8 places it in the high severity range, yet the EPSS score is below 1 %, suggesting that, although exploited, it is not currently a widespread target. The flaw is not listed in CISA’s KEV catalog. Attackers would need to supply a malicious ICC profile to the vulnerable code path; thus the likely vector is local or remote code that processes user‑supplied color profiles. Once the type confusion triggers a memory override, an attacker may achieve code execution or privilege escalation depending on the context in which iccDEV is used.