A heap buffer overflow exists in the CIccTagXmlSegmentedCurve::ToXml() function of iccDEV. When user‑controllable data is incorporated unsafely into ICC profile files or other binary blobs, the library can overrun its heap buffer, allowing an attacker to trigger a denial of service, corrupt data, bypass application logic and ultimately execute arbitrary code. The vulnerability corresponds to CWE‑122 and CW‑20 weaknesses.

The InternationalColorConsortium’s iccDEV library is affected for all releases version 2.3.1.1 and earlier. The issue was addressed in version 2.3.1.2 and later releases.

The CVSS base score is 8.8, indicating a high‑severity flaw, while the EPSS score of < 1 % suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires supplying a malicious ICC profile or structured binary blob to software that uses iccDEV; the attack vector is thus likely local or remote file input where the attacker can influence the data processed by the library. A successful attack would grant the attacker the ability to crash services, tamper with data, or run arbitrary code within the context of the application using the library.