The vulnerability causes a null pointer dereference within the iccDEV library when processing ICC color profiles. This defect can trigger a program crash or other undefined behavior such as memory corruption. The flaw is classified as CWE‑476, indicating that an object is used without ensuring it is properly instantiated. The primary impact is a potential denial of service for processes that handle color profiles, and in certain contexts may expose vulnerabilities that could be leveraged to manipulate memory structures.

The issue affects all releases of iccDEV from the International Color Consortium before version 2.3.1.2. Users who employ the iccDEV library to parse, manipulate, or apply ICC color profiles are directly impacted. No specific product lineage beyond the library is listed.

The CVSS score of 6.5 places the vulnerability in the medium severity range. An EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not present in the CISA Known Exploited Vulnerabilities list. Attackers would need the ability to deliver or influence the processing of ICC profiles in an environment that uses the vulnerable library, which is typically a local or application‑level scenario. No workarounds are known, so the recommended action is to update to the patched release.