The flaw is a heap buffer overflow in the iccDEV library that occurs when the iccFromXml tool parses malformed XML into ICC profiles. The overflow reads beyond the intended buffer, potentially exposing sensitive data or causing application instability. This weakness can be exploited to bypass integrity checks and exhibit memory corruption or a crash, affecting confidentiality and availability of the system.

All installations of the International Color Consortium’s iccDEV libraries and tools that use the CIccIO module, before the fix was released in version 2.3.1.3, are vulnerable. The issue does not affect later releases.

The CVSS score of 7.8 indicates high severity, but the very low EPSS score suggests a small chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog as of the last update. Exploitation requires delivery of crafted XML to the iccFromXml utility, which is typically a local operation but could be triggered automatically in applications that process user‑provided ICC data. Attackers might exploit this by positioning malicious XML in a location that the tool reads, thereby achieving memory corruption or a crash.