A heap out‑of‑bounds read occurs in the CIccCalculatorFunc::ApplySequence() function of iccDEV, causing the application that uses this library to crash. The vulnerability is a classic memory corruption flaw (CWE-125 and CWE-129) that leads to a denial‑of‑service rather than code execution or data exfiltration. The impact is limited to any process that loads and processes ICC profiles with the affected library, resulting in abrupt termination of that process.

International Color Consortium’s iccDEV library earlier than version 2.3.1.5 is susceptible. The fix is incorporated in release 2.3.1.5, available for all supported platforms. All systems that integrate iccDEV without upgrading before this version may experience crashes when processing certain ICC profiles.

The CVSS score of 6.1 places this vulnerability in the moderate severity range. The EPSS score is reported as less than 1%, indicating a very low probability of exploitation in the wild, and there is no indication it has been listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is the use of a crafted ICC profile that triggers the out‑of‑bounds read, which is a local or application‑level exploit. While the flaw does not grant attacker control of code or data, it can be abused to perform denial‑of‑service attacks against services handling color profiles.