A stack-based buffer overflow in the icFixXml function occurs when malformed ICC profiles containing crafted NamedColor2 tags are processed. This flaw can allow an attacker to execute arbitrary code, potentially compromising confidentiality, integrity, and availability. The vulnerability maps to the stack-based buffer overflow (CWE-121) and out‑of‑bounds memory access (CWE-787) weaknesses.

International Color Consortium’s iccDEV library is affected. All builds using iccDEV prior to version 2.3.1.2 are vulnerable, including applications that embed the library for ICC profile handling.

The CVSS score of 7.8 indicates a high severity impact. An EPSS score of less than 1% suggests a low likelihood of exploitation in the short term, and the vulnerability is not listed in the CISA KEV catalog. The attack requires delivery of a malicious ICC profile that is processed by an application linked to the vulnerable library. Such a profile could be introduced locally or via a network interface that accepts ICC files, making the attack vector likely local to the system or an application that accepts external profiles.