iccDEV, a library suite for interacting with ICC color management profiles, contains a stack-based buffer overflow in the method CIccTagFloatNum::GetValues() in all releases prior to 2.3.1.3. The flaw is triggered when a malformed ICC profile is parsed, causing an out-of-bounds write on the stack that may corrupt memory, leak sensitive data, or allow an attacker to execute arbitrary code. The issue is classified under CWE‑119, CWE‑121, CWE‑787, and CWE‑788, indicating typical buffer overflow weaknesses.

The vulnerability affects the International Color Consortium’s iccDEV product. All versions released before 2.3.1.3 are susceptible; the fix is available starting with the 2.3.1.3 release.

The CVSS score of 7.8 indicates a high severity, while the EPSS of <1% reflects a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to supply a specially crafted ICC file to an application that processes such profiles, making it a local or remote file-based attack depending on how the application uses iccDEV. Once triggered, the stack overflow could lead to memory corruption and potentially full code execution, presenting a significant but currently low likelihood risk.