A null pointer is passed to the memcpy function within the CIccTagSparseMatrixArray component of iccDEV, leading to undefined behavior. This flaw represents a CWE-476 null pointer dereference and a CWE-131 buffer handling weakness, which can corrupt memory, crash programs, or in the case of untrusted data, potentially facilitate arbitrary code execution. The impact is limited to code that uses the affected library to process ICC color profiles.

InternationalColorConsortium’s iccDEV library and associated tools before the release of version 2.3.1.2 are impacted. Versions 2.3.1.2 and later contain the patch that prevents the null pointer from being passed to memcpy. Any software that loads or manipulates ICC profiles via iccDEV on a vulnerable platform is susceptible.

The CVSS score of 6.1 indicates a medium severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to supply a malformed ICC profile that triggers the memcpy operation, which is most likely a local or privileged scenario rather than a remote attack. Consequently, the overall risk is moderate but largely mitigated by applying the vendor’s patch.