An undefined behavior flaw exists in iccDEV's CIccCLUT::Init function, which allocates and sizes the Color Lookup Table (CLUT). The bug originates from improper input validation (CWE‑20) combined with undefined memory handling (CWE‑758), allowing an attacker to craft a malformed ICC profile that can corrupt the program’s memory. Such corruption can lead to arbitrary code execution or program crashes, compromising confidentiality, integrity, and availability of systems that use the library.

The vulnerability affects the International Color Consortium’s iccDEV library, specifically versions 2.3.1 and earlier. The issue was corrected in version 2.3.1.1, so any installation of 2.3.1 or older is susceptible.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of <1 % suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack would require an adversary to supply a malicious ICC file to a process that loads the library, implying a local or privileged attacker scenario. While exploit evidence is scarce, the high CVSS and the potential for remote code execution make the risk significant if unpatched.