The vulnerability is a heap buffer over-read in the icXmlParseTextString() function of the iccDEV library. When a non‑null‑terminated string is processed, strlen() reads past the buffer boundary, potentially exposing on‑heap data and leading to a crash. This flaw corresponds to the buffer over-read weaknesses identified by CWE‑125 and the related buffer overrun CWE‑122, and can enable injection of malformed ICC profile data as described in CWE‑170.

Users of the International Color Consortium iccDEV library, versions earlier than 2.3.1.2, are affected. The library is used in applications that load, manipulate, or apply ICC color profiles.

The CVSS score of 6.1 indicates moderate severity. The EPSS rating is under 1 %, suggesting low current exploitation probability, and the asset is not listed in the CISA KEV catalog. Attackers that can supply crafted ICC profiles to an affected application, or otherwise influence the data processed by icXmlParseTextString(), could trigger the over-read, potentially leaking sensitive data or causing denial of service. Given the moderate CVSS and low EPSS, the urgency is lower than critical, yet patching remains advised to avoid crash scenarios and potential information exposure.