A memory corruption flaw exists in the ICC development libraries where a hint manager object is deleted prematurely during the creation of a transform. This Use After Free condition can lead to crashes and, if an attacker can control the deleted memory’s reuse, can be leveraged for arbitrary code execution. The weakness is categorized as a Use After Free and also indicates improper use of input data during memory management.

The vulnerability affects the International Color Consortium’s iccDEV libraries version 2.3.1 and earlier. The issue is resolved in version 2.3.1.1 and later releases. No other vendors or product lines are mentioned as impacted.

The flaw carries a high CVSS score of 9.8, indicating a severe risk, but its EPSS score is less than 1%, suggesting that exploitation is currently rare. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Likely exploitation would require execution of code that loads the affected library, such as through a local application or a specially crafted ICC profile that triggers the vulnerable function.