A critical stack-based buffer overflow in the International Color Consortium iccDEV library allows for memory corruption and potential system instability.

This vulnerability is a classic stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787) occurring within the CIccXform3DLut::Apply method. The flaw is triggered by processing maliciously crafted ICC color management profiles, requiring user interaction to execute.

Successful exploitation of this buffer overflow can lead to unauthorized memory corruption, resulting in service denial or potential code execution in the context of the application. Given the CVSS score of 7.8, this flaw represents a significant risk to data integrity and system availability. Organizations relying on this library for color management should prioritize remediation to avoid potential system crashes or unauthorized control.

Immediate Action: Update the iccDEV library to version 2.3.1.5 or later to resolve the overflow vulnerability.

Proactive Monitoring: Monitor application logs for unexpected termination or segmentation faults associated with image or profile processing modules.

Compensating Controls: Implement input validation on ICC profile uploads and ensure that applications utilizing this library are run with the least privilege necessary to limit the impact of a potential crash.

Public Exploit Available: No (exploit_available: false)

The vulnerability in the iccDEV library presents a high risk to systems processing untrusted ICC color profiles. Administrators should verify the current version of the library across their environment and apply the 2.3.1.5 patch immediately to eliminate the underlying memory safety issue.