A heap‑based buffer overflow exists in the function SIccCalcOp::Describe() within the IccProfLib/IccMpeCalc.cpp module of the iccDEV library. Because this function processes the contents of ICC color management profiles, an attacker who can supply a crafted profile may trigger memory corruption that can lead to arbitrary code execution or denial of service; whether code execution is achieved is inferred from the nature of the overflow and similar exploits. The vulnerability is identified as CVE-2026-22861 and is highlighted by the CVSS score of 8.8, indicating a high severity of potential impact on confidentiality, integrity, and availability.

The issue affects installations of the International Color Consortium’s iccDEV library that are older than version 2.3.1.2. Any application or system that utilizes iccDEV to load or manipulate ICC profiles is within the scope of the vulnerability.

The CVSS base score of 8.8 reflects a high likelihood that exploitation could compromise the host. EPSS scoring of less than 1% suggests that successful exploitation is not currently widespread, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the overflow arises from processing user‑supplied ICC data, an attacker who can control or influence profile inputs—directly or via remote uploads—is capable of exploiting the flaw. The attack does not appear to require privileged access beyond the ability to provide a malicious file to a process that links against iccDEV.