iccDEV includes a heap buffer overflow in the CIccMpeCalculator::Read() function. The flaw is triggered when user‑controllable data in ICC profile files or other structured binary blobs is parsed without proper bounds checking. If exploited, the overflow can corrupt heap memory, allowing an attacker to crash the application for denial of service, manipulate data, bypass application logic, or execute arbitrary code.

The International Color Consortium product iccDEV is affected. Versions 2.3.1.1 and all earlier releases contain the vulnerability. The fix is available in version 2.3.1.2 and later, which patches the unsafe parsing routine.

The vulnerability scores 8.8 on CVSS, indicating high severity. EPSS is reported as less than 1%, suggesting that the likelihood of exploitation in the wild is currently low and no known active exploits are documented. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is delivering a crafted ICC profile or binary blob to an application that uses iccDEV, which could be achieved remotely if such files are loaded from untrusted sources or locally if the attacker can influence the data supplied to the library. Proper validation of ICC data and application of the patch mitigates both denial‑of‑service and code‑execution risks.