The vulnerability lies in the CIccTagNum<>::GetValues() routine of the iccDEV library, where an ICC tag value is copied into a buffer without proper bounds checking. This results in a stack buffer overflow that can corrupt stack memory or trigger a crash. The flaw is classified as a memory corruption weakness (CWE-120, CWE-121, CWE-787). If exploited with a malicious ICC profile, an attacker could potentially hijack program flow or cause a denial of service by terminating the process.

The product affected is iccDEV, a collection of C and C++ libraries and tools for ICC color profile handling developed by the International Color Consortium. Versions earlier than 2.3.1.5 are vulnerable; the 2.3.1.5 release contains the applicable fix.

The CVSS score of 7.8 signals high severity, and the EPSS score under 1% indicates a low but non‑zero likelihood of exploitation. No publicly confirmed exploits are listed in CISA’s KEV catalog. The flaw is likely triggered by parsing a crafted ICC file, so the attack vector involves supplying a malicious profile to any application that processes ICC data with the vulnerable library.