The iccDEV library contains critical memory corruption flaws that could allow an attacker to achieve arbitrary code execution or cause a system crash.

The vulnerability consists of Use After Free, Heap-based Buffer Overflow, Integer Overflow, and Out-of-bounds Write errors within the CIccSparseMatrix::CIccSparseMatrix function. These flaws can be triggered by an unauthenticated user if they can provide a maliciously crafted ICC color management profile to the application.

Successful exploitation of these memory corruption vulnerabilities could allow an attacker to gain control over the affected application or cause significant service disruption. Given the high CVSS score of 7.8, these flaws represent a high risk to data integrity and system availability, particularly in environments that process untrusted image files.

Immediate Action: Update the iccDEV library to version 2.3.1.2 or later to apply the necessary memory safety fixes.

Proactive Monitoring: Monitor system logs for unusual application crashes or segmentation faults that may indicate an attempt to trigger these memory corruption conditions.

Compensating Controls: Implement input validation routines for all uploaded or processed ICC profiles to ensure they conform to expected standards, preventing the ingestion of malformed files.

Public Exploit Available: No — there is no confirmed public exploit available in our curated sources.

The vulnerabilities identified in the CIccSparseMatrix function present a substantial risk to any software utilizing the iccDEV library. Organizations must prioritize updating to version 2.3.1.2 immediately to neutralize these memory corruption vectors and ensure the continued security and stability of their color management workflows.