iccDEV contains a memory leak in the CIccProfileXml::ParseTag() error path used during XML MPE parsing. When malformed XML is processed, the routine fails to release allocated memory, causing a gradual increase in usage. Repeated exploitation can exhaust system memory, crashing the application or any dependent services and resulting in a denial‑of‑service condition.

The issue affects the InternationalColorConsortium’s iccDEV library, specifically versions 2.3.1 and earlier. The fix was introduced in version 2.3.1.1, which is not affected.

The CVSS score of 3.3 indicates low severity, and the EPSS score of less than 1 % suggests a very low likelihood of real‑world exploitation. The vulnerability requires the attacker to supply crafted XML data to the iccDEV parser; the likely attack vector is through local or remote applications that import untrusted ICC profiles. The vulnerability is not listed in the CISA KEV catalog, but continuous monitoring is advisable due to the denial‑of‑service risk.