A buffer overlap in the CIccTagMultiProcessElement::Apply() function causes src and dest stack buffers to interfere, creating an out‑of‑bounds write that can corrupt memory and potentially allow an attacker to execute arbitrary code or corrupt data managed by the library.

InternationalColorConsortium’s iccDEV library, any version released before 2.3.1.4, is affected. The vulnerability was fixed in release 2.3.1.4 and later.

The CVSS score of 7.8 reflects a high severity associated with memory corruption. EPSS indicates a very low exploitation probability (<1%), and the vulnerability is not listed in CISA’s KEV catalog. Exploitation likely requires the attacker to invoke the vulnerable library function within a process that has sufficient privileges, implying a local or application‑level attack vector rather than remote exploitation.