Versions of iccDEV before 2.3.1.2 contain a heap-buffer-overflow in CIccProfileXml::ParseBasic() when parsing ICC color profiles. The flaw may result in memory corruption, application crashes, or, if exploited, arbitrary code execution. The vulnerability is listed under multiple CWEs, including buffer overflow and unchecked assignment.

The International Color Consortium’s iccDEV library is affected, specifically all releases prior to 2.3.1.2. Users of the library who process ICC profiles are at risk.

The CVSS score of 8.8 signals a high severity level, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not currently catalogued in CISA’s KEV list. An attacker would need to supply a crafted ICC profile that is parsed by an application using the vulnerable library; the attack vector is inferred to be local or remote depending on the application’s context, but the description does not state limitations, so it is considered potentially exploitable whenever untrusted profiles can be processed.