A null pointer dereference occurs within the XML parser component of the iccDEV library. When a specially crafted XML payload is processed, the parser fails to validate a needed pointer, leading to a crash. This flaw results in a denial of service for any application that relies on iccDEV to handle color profiles. The weakness represents a classic input validation error and unchecked null dereference, corresponding to CWE‑20, CWE‑476, and CWE‑690. While the crash does not grant an attacker new privileges or data, it can expose unstable memory states before the fault triggers and disrupt workflow continuity.

All versions of the International Color Consortium’s iccDEV software released prior to 2.3.1.2 are affected. No other vendors or product lines are reported to be impacted by this flaw.

The CVSS base score of 5.5 categorizes the vulnerability as moderate severity. An EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. The most probable attack vector is local: an actor who can supply XML input to the parser can trigger a crash, causing a denial of service. If the parser is exposed to untrusted input from remote users, a remote attacker could similarly induce a service outage. There is no evidence of privilege escalation or data exfiltration.