icdev, a library for ICC color profile manipulation, contains a null pointer dereference flaw in its XML tag parser in versions older than 2.3.1.2. The vulnerability is triggered when the parser receives unexpected or malformed XML input, causing the program to crash. A crash results in a denial of service that could interrupt color management services or any application relying on iccDEV, leading to loss of availability but not compromising confidentiality or integrity. The attack vector is inferred to be the supply of malformed XML to the library, which may occur locally or remotely depending on how iccDEV is employed.

The affected product is iccDEV from the International Color Consortium. Versions before 2.3.1.2 are impacted; all releases newer than 2.3.1.2 contain the fix. The vulnerability was formally documented at the vendor's repository and is included in the community security advisories.

With a CVSS score of 5.5 the vulnerability is classified as moderate. The EPSS score is below 1%, indicating a very low probability of exploitation. It is not listed in the CISA KEV catalog. An attacker would need access to the XML input path of the library, which may be local or remote depending on how iccDEV is used. The specific attack vector is not stated in the CVE description; it is inferred that the threat arises from supplying malformed XML through any input channel the library exposes. Exploitation typically results in a program crash rather than arbitrary code execution.