iccer provides libraries for manipulating ICC color profiles. Versions prior to 2.3.1.2 contain a null pointer member call that can be triggered when processing ICC profiles, causing the application to crash. The vulnerability does not provide arbitrary code execution or privilege escalation; its primary impact is a denial of service by terminating the process that handles the profile.

The affected product is iccDEV from the International Color Consortium, specifically library versions older than 2.3.1.2. Users who utilize these libraries to process ICC color profiles are impacted. The patch that mitigates the issue is included in release 2.3.1.2.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is below 1% and the vulnerability is not listed in the National Cyber Awareness System KEV catalog, suggesting a low likelihood of widespread exploitation. An attacker would need local access to an application that processes ICC profiles; no network-facing or elevated privilege exploitation is required. The vulnerability primarily disrupts availability rather than confidentiality or integrity.