The iccDEV library, used for processing ICC color profiles, contains critical memory corruption vulnerabilities that could allow an attacker to achieve code execution or system compromise.

The vulnerability resides in the CIccXmlArrayType::ParseTextCountNum function, where integer overflows and incorrect type conversions occur. These flaws are triggered when processing malicious ICC color profiles, and the attack vector is local, requiring user interaction to process a malformed file.

Successful exploitation of these flaws can lead to arbitrary code execution, system crashes, or data corruption. Given the CVSS score of 7.8, this vulnerability poses a high risk to organizational security, particularly for workstations or servers that process untrusted ICC color management data.

Immediate Action: Update the iccDEV library to version 2.3.1.1 or later immediately to resolve the identified integer overflow and type conversion issues.

Proactive Monitoring: Review application logs for unexpected crashes or error messages occurring during the parsing of image or color profile data.

Compensating Controls: Implement file integrity monitoring and restrict the processing of ICC profiles from untrusted sources to limit the potential attack surface.

Public Exploit Available: Unknown.

Organizations utilizing the iccDEV library must prioritize patching to version 2.3.1.1. Because this library is often a dependency within larger software suites, IT administrators should verify their software bill of materials to identify vulnerable components and ensure the update is applied across all production environments.