iccDEV libraries contain an undefined behavior and an out-of-memory bug in the CIccProfile::LoadTag() routine. The flaw can cause the application to crash or consume excessive memory when processing a malformed ICC profile, leading to service interruptions. The scenario where a crafted or malformed ICC profile triggers the flaw is inferred from the description that the vulnerability occurs during profile loading. The vulnerability is classified with several CWEs, including resource exhaustion, out-of-bounds read, type confusion, integer overflow, and null pointer dereference, which together contribute to the high CVSS score of 8.8.

All systems installing the International Color Consortium iccDEV packages at version 2.3.1.1 or earlier are vulnerable. This includes any environment that uses iccDEV to load or manipulate ICC color profiles.

Based on the description, it is inferred that an attacker would need to supply a crafted ICC profile that triggers the LoadTag() routine to exploit the vulnerability. The EPSS score is below 1%, indicating a low current likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would primarily cause a denial of service rather than remote code execution. While the statistical risk is modest, the potential service disruption warrants prompt action.