The vulnerability in iccDEV arises from an improper array bounds validation when parsing a malformed ICC profile in IccCmm.cpp:5793. This defect allows an attacker to provoke an out-of-bounds read, potentially exposing sensitive memory contents or causing a segmentation fault. The weakness is associated with several buffer-overflow related weaknesses including improper bounds checking, signed to unsigned conversion errors, and invalid memory reads.

The affected product is the iccDEV library released by International Color Consortium. All versions prior to 2.3.1.3 are vulnerable; the issue was addressed in release 2.3.1.3 and later.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not currently listed in the CISA KEV catalog. An attacker could exploit the flaw by supplying a crafted ICC profile to any application that processes profiles through the iccDEV library, potentially leading to information disclosure or denial of service. The exploit requires the victim to parse the malicious profile, which may occur in professional imaging, printing, or graphics workflows.