The vulnerability is a heap‑buffer overflow in the SIccCalcOp::Describe() function located in IccProfLib/IccMpeCalc.cpp. When an ICC profile is processed, an out‑of‑bounds write can corrupt heap data, potentially allowing an attacker to execute arbitrary code or crash the application. The weakness is a classic example of unsafe memory handling, falling under CWEs 20, 130, 252, and 787, which cover buffer overflows, unchecked input, failed checks of array bounds, and use‑after‑free scenarios. The vulnerability is present in all versions of iccDEV older than 2.3.1.2 and has no publicly available workaround, but version 2.3.1.2 includes a patch that eliminates the overflow.

The affected product is the International Color Consortium’s iccDEV library, which is used for manipulating ICC color management profiles. All releases prior to version 2.3.1.2 are vulnerable; users who process ICC profiles with those older versions are at risk.

With a CVSS score of 8.8 the vulnerability is considered high severity. The EPSS score is less than 1 %, indicating it is not widely exploited at the time of analysis, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves supplying a crafted ICC profile to a vulnerable application, which could lead to code execution. Although exploitation probability is low, the high potential impact warrants rapid mitigation.