Versions of the iccDEV library before 2.3.1.2 contain a type confusion vulnerability in CIccProfileXml::ParseBasic(). When parsing an ICC color profile, this flaw allows an attacker to construct input that causes the library to treat data as an incorrect type, potentially leading to memory corruption. Such corruption could enable arbitrary code execution, compromise confidentiality, integrity, and availability of the system hosting the library if malicious profiles are processed.

The International Color Consortium’s iccDEV library is affected. All releases prior to 2.3.1.2 are vulnerable. The patch was integrated in version 2.3.1.2 and later.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the short term. The vulnerability is not listed in the CISA KEV catalog, but the type confusion flaw could be leveraged if an attacker can supply or control ICC profiles processed by the application. The likely attack vector is local or remote data injection through crafted ICC profiles supplied by an attacker.