ICCDEV's CIccXform3DLut::Apply function performs an unchecked memory write that overwrites data on the stack, which can lead to a crash or unpredictable behavior. The vulnerability represents a classic stack buffer overflow (CWE-120, CWE-121, CWE-787) and may also allow an attacker to corrupt application state if they supply crafted input. While the description does not confirm arbitrary code execution, the nature of the flaw introduces the possibility of executing unintended instructions under favorable conditions.

The ICCDEV library produced by the International Color Consortium is affected. All releases before version 2.3.1.5 contain the vulnerability. Software that links either statically or dynamically to these earlier libraries is therefore at risk until the fix is applied.

The CVSS score of 7.8 classifies the issue as high severity. EPSS indicates a less than 1% probability of exploitation at the time of this report. The vulnerability is not listed in the CISA KEV catalog, so there are no known active or publicly documented exploits. The likely attack vector involves an application that feeds untrusted or malformed 3‑D LUT data to the library; a local user or process with write access to the affected code path can trigger the overflow. Absent a privilege escalation or additional configuration weaknesses, the impact is most likely limited to a denial of service, but deterministic arbitrary code execution is not established by the available data.