The vulnerability is an integer overflow in the CIccProfile::CheckHeader() routine of iccDEV. When a victim loads a profile containing user-controllable tag tables, offsets, or size fields, the overflow can lead to parsing errors, memory corruption, or a denial of service. The corrupted memory state could be exploited to execute arbitrary code or to bypass normal application logic. The weakness is reflected by the CWE identifiers for integer overflow and improper input validation.

International Color Consortium’s iccDEV libraries and tools are affected. All releases up to and including version 2.3.1.1 are vulnerable. Version 2.3.1.2 contains the fix and is the recommended minimum version to use.

The CVSS score of 7.1 indicates substantial impact and the EPSS score of less than 1% suggests that, while exploitation does occur in the wild, it is currently rare. The vulnerability is not listed in the CISA KEV catalog, so there are no known large-scale campaigns targeting it. Attackers would likely craft a malicious ICC profile that an application accepts, making the attack vector likely local or remote depending on how the profile is delivered. Because the flaw can lead to arbitrary code execution, organizations should treat it as high risk when the affected software processes untrusted input.