The vulnerability is a type confusion in the IccXML/IccLibXML/IccMpeXml.cpp component of the iccDEV library. The flaw arises in the ToXmlCurve() function when handling ICC color profiles. This leads to improper type conversion and out‑of‑bounds memory access, as indicated by the listed CWEs. The result is a condition that can corrupt memory or change program control flow, which may be leveraged by an attacker to execute arbitrary code or disrupt the integrity of the application processing the profiles.

All installations of InternationalColorConsortium iccDEV versions earlier than 2.3.1.2 are affected. The issue exists in the core library used to parse and transform ICC profiles and applies to any system that uses these libraries to handle color profiles, regardless of operating system.

The CVSS score of 8.8 classifies the risk as high. The EPSS score is below 1 %, indicating a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a crafted ICC profile to the vulnerable library; this can be achieved through any medium that the application accepts such profiles—email, file uploads, or network exchange. No known mitigations exist until the library is upgraded, so the primary defense is to avoid processing untrusted profiles.