A heap‑based buffer overflow exists in the icCurvesFromXml() routine of the iccDEV library, which processes XML curve data for ICC color profiles. The flaw arises from improper bounds checking and is classified as CWE‑122 and CWE‑787. An attacker can supply a crafted XML file that triggers the overflow, corrupting heap memory, causing the application to crash.

The vulnerability affects versions of the International Color Consortium’s iccDEV library older than 2.3.1.5. Systems that load or convert ICC profiles using this library, or applications that embed the library, are at risk if they process untrusted XML content. This includes any software that accepts user‑supplied color profiles in environments where the library is available.

The CVSS score of 7.8 indicates high severity, while the EPSS of less than 1% suggests a low exploitation likelihood at present. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation would likely require delivery of a malicious XML profile to an application that calls icCurvesFromXml(), making it a local or file‑based threat unless the library is exposed through a network‑accessible service. No remote exploit path is documented. The impact is limited to the host running the vulnerable library, as the overflow occurs on the heap within the process.