Integer overflow in iccFromCube.cpp during multiplication can trigger undefined behavior, which may lead to application crashes or the creation of invalid ICC color profiles when processing crafted or excessively large cube inputs.

Vulnerable versions of the InternationalColorConsortium’s iccDEV library up to and including 2.3.1.4 are affected. The vulnerability exists in the iccFromCube module that parses cube data used for color profiling.

The CVSS score of 6.2 reflects moderate severity, while an EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attack would require an attacker to supply a malicious ICC profile that includes a large cube to an application that relies on iccDEV for profile handling; thus the vector is likely local or depends on the ability to deliver crafted input to software that uses the library.