The vulnerability is a heap‑buffer‑overflow located in the CIccCLUT::Init() function of the iccDEV library (IccProfLib/IccTagLut.cpp). When a malformed ICC profile is parsed, the library can write beyond the bounds of a heap buffer, corrupting adjacent memory. This corruption can be leveraged by an attacker to execute arbitrary code or crash the application, violating confidentiality, integrity, and availability of the host system.

InternationalColorConsortium:iccDEV libraries that process ICC color profiles are affected. All releases earlier than version 2.3.1.2 are vulnerable. The patch is included in iccDEV 2.3.1.2 and later, so any installation using those earlier versions must be considered compromised until updated.

The CVSS score of 8.8 indicates a high severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of immediate exploitation in the wild. However, the attack requires the delivery of a crafted ICC profile to an application that uses iccDEV, which is common in many imaging, printing, and publishing workflows. Because the flaw is a classic heap overflow, it carries the potential for arbitrary code execution once triggered.