iccDEV, a library suite for ICC color management, contains a heap‑based buffer overflow in the CIccMatrixMath::SetRange() function. When the function writes beyond the bounds of an allocated buffer, the overflow corrupts adjacent heap memory, which can lead to application crashes or other unpredictable behavior. The flaw is an out‑of‑bounds write that violates memory safety and can disrupt color processing tasks, but does not directly provide an execution path for arbitrary code.

Systems that embed the International Color Consortium’s iccDEV library older than version 2.3.1.5 are susceptible. The fix is included in release 2.3.1.5 and later, so any installation using that or an older version should be identified. The affected code is part of the library’s core mathematical operations used in color management workflows on both desktop and server environments.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation at present, and the vulnerability is not cataloged in the CISA KEV database. Attacks would require a local or privileged process that can supply crafted input to the library function, so remote exploitation is unlikely. The primary risk remains denial of service or memory corruption that could compromise applications relying on iccDEV.