ICC Color Consortium’s iccDEV contains a null pointer dereference in its unknown tag parser, which can be triggered by an attacker supplying a malformed ICC profile. The flaw allows the application to crash, resulting in a denial of service. This vulnerability is an example of unchecked input leading to an invalid memory access, marked by CWE‑20, CWE‑476 and CWE‑252.

The issue affects the iccDEV libraries and tools distributed by the International Color Consortium, specifically any release prior to version 2.3.1.2. Version 2.3.1.2 and later incorporate the fix.

The CVSS vector scores a 5.5, indicating moderate severity, and the EPSS score is reported as less than 1 %, suggesting a low probability of exploitation so far. The vulnerability requires the attacker to supply a crafted ICC profile that contains an unknown tag, which then causes the parser to dereference a NULL pointer and crash. Currently the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploits have been disclosed. Nonetheless, the potential for disrupting services that rely on iccDEV warrants timely remediation.