A heap‑buffer overflow in the CIccApplyCmmSearch::costFunc function of the iccDEV library can be triggered when the iccApplySearch tool processes a malformed JSON configuration file. The out‑of‑bounds read may lead to memory corruption or expose sensitive data that resides near the buffer. This weakness is recorded as CWE‑125.

The vulnerability applies to all deployments of InternationalColorConsortium’s iccDEV libraries and tools that are older than version 2.3.1.6. Any installation that uses the iccApplySearch utility with configuration files that are not fully trusted is potentially affected.

The CVSS base score is 6.2, reflecting moderate severity. No EPSS score is available, so the probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or compromised execution of a crafted JSON file against the iccApplySearch command; this inference is based on the description that the flaw can be triggered via malformed JSON configuration input, which is not explicitly stated in the data.