This vulnerability is a heap out‑of‑bounds read in CTiffImg::ReadLine() within the iccApplyProfiles function of the iccDEV library. The flaw, classified as CWE‑125 and CWE‑787, allows a crafted TIFF image to cause either a memory disclosure or a crash. The vulnerability is local in nature and can potentially expose sensitive data residing on the system’s memory space when the library processes malicious image data.

The affected product is InternationalColorConsortium’s iccDEV library. Versions earlier than 2.3.1.5 are vulnerable. The security fix is delivered in release 2.3.1.5.

The CVSS score of 6.1 indicates a medium severity impact. EPSS scoring below 1 % signals a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting there are no known widespread attacks. Attackers would need to supply a malicious TIFF image to a process using iccDEV, which is typically local to the application. Successful exploitation could result in the disclosure of sensitive memory contents or an application crash, potentially leading to denial of service on the host system.