A malformed ICC profile can trigger a heap‑buffer‑overflow in the icMemDump function of iccDEV. The overflow occurs when the library reads malformed tag contents during a profile dump, resulting in an out‑of‑bounds heap read. This weakness is classified as CWE‑122 and can cause unhandled crashes or unintended disclosure of memory contents.

All releases of International Color Consortium’s iccDEV library older than version 2.3.1.6 are vulnerable. Applications that load or dump ICC profiles via iccDEV without validating the profile are impacted unless running the patched release.

The CVSS score of 6.2 indicates a medium severity vulnerability. No EPSS score is available, and the flaw is not in the CISA KEV catalog. The likely attack vector is local, where an attacker supplies a crafted ICC profile to an application that uses iccDEV; it may also be exploitable from remote if the profile is transmitted to a remote service that processes it. Exploitation would produce a crash or potential data exposure, but it requires the affected application to process the malicious profile.