A heap-based buffer overflow vulnerability in the International Color Consortium iccDEV library allows a local attacker to cause memory corruption or system crashes.

This is a heap-based buffer overflow (CWE-122) within the CIccCalculatorFunc::InitSelectOp function. The flaw is triggered by local user interaction with a maliciously crafted ICC profile, which leads to an out of bounds write.

The vulnerability carries a CVSS score of 7.8, reflecting its potential for high impact on system integrity and availability. Although it requires local user interaction, a successful exploit can lead to arbitrary code execution or service disruption, potentially compromising the host system where color management tools are deployed.

Immediate Action: Update the iccDEV library to version 2.3.1.5 or later, which contains the upstream fix for this memory corruption issue.

Proactive Monitoring: Monitor system logs for unexpected application crashes or memory access violations that correlate with the processing of ICC profile files.

Compensating Controls: Restrict permissions on systems processing untrusted ICC profiles to ensure that only authorized users can initiate color management operations.

Public Exploit Available: Unknown

Given the potential for total technical impact, organizations utilizing the iccDEV library must prioritize updating to version 2.3.1.5. Applying this update is the only definitive way to remediate the underlying heap-based buffer overflow and prevent potential exploitation via malicious ICC profile files.