A critical stack-based buffer overflow vulnerability in the International Color Consortium iccDEV library allows an attacker to trigger memory corruption or system crashes.

This vulnerability is a classic stack-based buffer overflow occurring in the CIccTagNum::GetValues function due to inadequate input size validation. The flaw can be triggered by an unauthenticated attacker providing a malformed ICC color management profile.

The vulnerability carries a CVSS score of 7.8, reflecting its potential for severe impact on confidentiality, integrity, and availability. Successful exploitation may lead to arbitrary code execution or service disruption, potentially compromising the stability of systems that process ICC profiles and exposing sensitive data or enabling further unauthorized access.

Immediate Action: Update the iccDEV library to version 2.3.1.5 or later to incorporate the necessary bounds checking.

Proactive Monitoring: Monitor application logs for unexpected crashes or error patterns associated with color profile processing.

Compensating Controls: Implement rigorous input validation and sandboxing for any services that handle untrusted ICC profile files to restrict the impact of potential memory corruption.

Public Exploit Available: No

Given the potential for memory corruption and the high severity score, organizations utilizing the iccDEV library should prioritize upgrading to version 2.3.1.5 immediately. Administrators should treat this update as a standard security maintenance task to ensure the integrity of systems involved in graphic processing and color management.