A heap-based buffer overflow exists in the CIccCalculatorFunc::InitSelectOp() routine of iccDEV, a library used for processing ICC color management profiles. When a local user supplies specially crafted input, the function fails to validate buffer boundaries, causing uncontrolled memory writes that corrupt heap memory and lead to a crash or potential arbitrary code execution. The flaw is tied to common CWE vulnerabilities involving buffer overflows and memory corruption.

The bug affects all installations of the InternationalColorConsortium's iccDEV software released prior to version 2.3.1.5. Users running earlier releases of the library that reference CIccCalculatorFunc need to upgrade to the patched version to eliminate the vulnerable code paths.

The CVSS score of 7.8 classifies the flaw as high severity. Because the trigger requires local user interaction, the exploitability is limited to users who can directly invoke the vulnerable function; however, the potential for memory corruption or arbitrary code execution makes it a serious risk. The EPSS score of less than 1% suggests that current exploitation probability is low, and the vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog, reducing the urgency of immediate detection but still warranting rapid remediation.