The libultrahdr library suffers from a heap-buffer-overflow vulnerability triggered in the ultrahdr::IccHelper::readIccColorGamut function. The overflow occurs during the processing of ICC color gamut data, as identified by OSS-Fuzz. The crash involves reading beyond allocated heap memory, which may lead to memory corruption or application crashes. Affected versions explicitly include 1.3.1, 1.4.0, 1.5.0, 1.5.1, and all versions from the specified commit hash onward. There is no available information about a patch or fix from the vendor, and no active exploitation has been observed.

This vulnerability can cause heap memory corruption due to out-of-bounds reads, potentially leading to application crashes or undefined behavior. The absence of known exploits in the wild suggests limited current risk, but the vulnerability could be leveraged in targeted attacks if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider avoiding processing untrusted ICC color gamut data with affected versions of libultrahdr or apply additional sandboxing or memory protection measures where feasible.