A null pointer dereference occurs in the CIccProfileXml::ParseBasic() function of iccDEV when parsing ICC profile XML data. If an attacker can supply a crafted XML file or otherwise invoke the function with null or malformed input, the application will crash, disrupting service availability. This flaw does not lead to data exposure or code execution; its impact is limited to service downtime. The weakness is a classic input validation issue (CWE-20) coupled with an improper null reference check (CWE-476).

The vulnerability affects the InternationalColorConsortium’s iccDEV libraries and tools. All releases prior to version 2.3.1.2 are impacted; version 2.3.1.2 and later contain the fix.

The base score is 5.5, indicating a medium severity. The EPSS probability is below 1%, suggesting a low likelihood of exploitation. The vulnerability is not catalogued in the CISA KEV list. Though the attack vector is not explicitly detailed in the advisory, it is inferred that an attacker could trigger the crash by providing malicious or malformed XML input to the CIccProfileXml::ParseBasic() routine. The risk is primarily to availability for systems that process ICC profiles on an open or unfiltered basis.