The vulnerability resides in the icFixXml() function of the iccDEV libraries, where a strcpy call copies input without bounds checking. By providing a crafted ICC profile, an attacker can overflow the stack buffer, resulting in memory corruption that may crash the process or corrupt adjacent stack data. The CVE description states only stack memory corruption or crash, with no indication of arbitrary code execution.

International Color Consortium’s iccDEV libraries and tools before version 2.3.1.5 are affected. All releases newer than 2.3.1.5 contain the patch that removes the unsafe strcpy and prevents the overflow.

The vulnerability scores 7.8 on the CVSS score and has an EPSS probability of less than 1 %. It is not listed in the CISA KEV catalog, indicating no confirmed exploited public attacks. Likely exploitation requires the supply of a maliciously crafted ICC profile that triggers icFixXml(), which suggests a local or remote vector that can be exercised by any user or service parsing such profiles. With moderate to high severity and a low probability of exploitation, the risk remains significant for systems that routinely process untrusted ICC profiles.