iccDEV libraries contain a heap‑buffer‑overflow read in the CIccXmlArrayType<>::DumpArray() function, allowing an attacker to read memory beyond the intended buffer. This vulnerable code path can lead to a program crash or the disclosure of non‑public information. The issue is classed under CWE‑120, CWE‑125, and CWE‑787, which are all related to heap buffer overreads and related memory corruption weaknesses.

All installations of International Color Consortium iccDEV older than version 2.3.1.5 are affected. The vulnerability exists in the core library and any tool that imports or processes ICC XML profiles via this function. Version 2.3.1.5 and later include the fix.

The CVSS score 6.1 categorizes this as a medium severity vulnerability. Exploit probability is low with an EPSS score of less than 1 %. It is not listed in the CISA KEV catalog, indicating no known large‑scale exploited instances. Based on the description, the likely attack vector is local or within any process that loads ICC profiles; an attacker would need to supply crafted XML data to trigger the overflow, thus requiring some level of input control.