The vulnerability in iccDEV is caused by an invalid enumeration value that triggers undefined behavior in the library code. When an invalid enum is passed to iccDEV functions, the resulting memory access or control flow may become unpredictable, potentially causing application crashes, memory corruption, or other erratic behavior. The underlying weaknesses are reflected by CWE‑20 (Improper Input Validation) and CWE‑843 (Inconsistent Type Conversion or Interpretation).

The affected product is the InternationalColorConsortium iccDEV library and tools, specifically any releases prior to version 2.3.1.2. Versions 2.3.1.2 and later contain the patch that eliminates the undefined behavior triggered by invalid enum values.

The CVSS score of 5.5 indicates moderate severity, while the EPSS probability of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is currently not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would most likely require local access to an application that utilizes iccDEV and provides the opportunity to supply an invalid enumeration value, rather than being reachable via the network. As a result, the overall risk level is moderate but should be mitigated promptly to prevent unintended crashes or data corruption.