iccDEV implements ICC color management profile handling and contains a size_t underflow in the CIccEmbedIO::Read8() routine. Parsing profiles with the icSigEmbeddedV5ProfileTag and icSigEmbeddedProfileType payload can trigger the underflow, resulting in a memory corruption condition that may crash the application or allow an attacker to execute arbitrary code if the corruption is leveraged.

The vulnerability afflicts all releases of the InternationalColorConsortium iccDEV libraries and tools prior to version 2.3.2.1. The supplied patch in v2.3.2.1 removes the defect. ICC profiles from untrusted sources that contain the problematic tags can trigger the issue.

The CVSS score of 6.5 indicates a moderate impact, and the EPSS score is not available, making it unclear how frequently the flaw is being attempted. The vulnerability is not listed in CISA’s KEV catalog. Because an attacker must supply a crafted ICC profile, the attack vector is likely local or through an application that processes profile files. The lack of a workaround means that upgrading the library is the only effective mitigant.