The vulnerability lies in the CalcProfileID function within iccDEV’s IccProfile.cpp source. An infinite loop condition triggers when processing profile identifiers, causing the application or library to become unresponsive. The weakness is classified as CWE‑835, which directly leads to a denial of service; confidentiality and integrity are not impacted, and exploitation results in halted processing rather than data exposure.

The affected product is the InternationalColorConsortium iccDEV library. Versions up to and including 2.3.1 contain the issue. The defect was corrected in release 2.3.1.1.

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in current threat data. The vulnerability is not listed in the CISA KEV catalog, reinforcing that it is not actively exploited. Based on the description, the attack vector is likely local or requires an attacker to invoke the library with crafted inputs. An attacker could trigger the infinite loop by causing the CalcProfileID function to receive problematic data, after which the process would consume CPU resources indefinitely until terminated.