The iccDEV library contains a heap-based buffer overflow vulnerability that could allow for memory corruption or arbitrary code execution when processing malicious ICC profiles.

This is a heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) occurring within the icCurvesFromXml function. The vulnerability is triggered when an application processes a crafted ICC profile, requiring user interaction to open the malicious file.

The vulnerability carries a CVSS score of 7.8, classifying it as a High severity issue. Successful exploitation could lead to total system compromise, including the execution of arbitrary code or significant service disruption, which poses a severe risk to data integrity and system availability for organizations relying on this library for color management.

Immediate Action: Upgrade to version 2.3.1.5 or later of the iccDEV library to incorporate the security fix provided by the vendor.

Proactive Monitoring: Monitor application logs for abnormal crash patterns or unexpected process terminations associated with ICC profile parsing.

Compensating Controls: Implement input validation on uploaded or processed color profile files and ensure that applications utilizing iccDEV run with the minimum necessary user privileges to limit the impact of potential memory corruption.

Public Exploit Available: No (exploit_available: false)

Given the High severity of this heap-based buffer overflow, immediate action is required to patch the iccDEV library. Organizations must prioritize updating to version 2.3.1.5 to prevent potential memory corruption and unauthorized code execution resulting from the processing of untrusted ICC profiles.