iccDEV is a library for manipulating ICC color management profiles. Before version 2.3.1.2 its signature parser can dereference a NULL pointer when processing an ICC profile signature, causing the process to crash. The impact is a disruption of services that use the library, potentially resulting in a denial of service. The CVE description does not indicate remote code execution; it only describes a local crash.

The affected product is International Color Consortium’s iccDEV. All versions older than 2.3.1.2 are vulnerable; version 2.3.1.2 and later contain the fix.

The CVSS score of 5.5 signals moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Attackers could supply a crafted ICC profile file to trigger the parser; if the library is used by a privileged or server‑side application, a crash could be leveraged to disrupt availability. The likely attack vector is file or input based; no network‑based exploitation is described.