This vulnerability introduces a stack-buffer-overflow in the CIccTagFixedNum::GetValues() routine of the iccDEV library. When this function calls CIccTagStruct::GetElemNumberValue(), a write of four bytes exceeds the size of a four-byte stack variable, corrupting the local stack frame. The result is a memory corruption that can lead to an application crash and denial of service. No evidence in the provided description indicates escalation of privileges or execution of arbitrary code, only potential instability and memory corruption.

The issue affects all releases of iccDEV from the International Color Consortium prior to version 2.3.1.6. The library versions beginning with 2.3.1.6 contain the patch that resolves the overflow.

The CVSS base score of 6.2 describes moderate severity. The Exploit Prediction Scoring System score is not available, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is likely local, triggered when an application uses the vulnerable library to process an ICC profile that contains a CIccTagFixedNum tag. Remote exploitation is not documented in the supplied data.