A heap-based buffer overflow vulnerability in the InternationalColorConsortium iccDEV library poses a critical risk of remote code execution for applications processing malformed ICC profiles.

The vulnerability is caused by improper input validation (CWE-20) leading to a heap-based buffer overflow (CWE-122) within the CIccTagNamedColor2::SetSize function. An unauthenticated attacker can trigger this flaw by providing a malicious ICC profile containing crafted binary data, which the library processes without sufficient bounds checking.

The potential impact of this vulnerability is severe, as it facilitates unauthorized code execution, data corruption, and service disruption. Given the CVSS score of 8.8, this flaw represents a significant risk to the integrity and availability of any system or software relying on the iccDEV library for color management. Successful exploitation could allow an attacker to gain control over affected processes, leading to complete system compromise.

Immediate Action: Update the iccDEV library to version 2.3.1.2 or later immediately to incorporate the necessary memory safety patches.

Proactive Monitoring: Review application logs for abnormal crashes or memory access violations that occur when importing or processing ICC color profile files.

Compensating Controls: Implement file validation processes to scan incoming ICC profiles for structural anomalies before passing them to the iccDEV library for processing.

Public Exploit Available: Unknown.

Given the high CVSS severity and the existence of a proof-of-concept, organizations must prioritize patching this library. Ensure that all downstream applications utilizing iccDEV are updated to version 2.3.1.2 to eliminate the underlying heap overflow condition and prevent potential remote code execution.