The vulnerability arises from undefined behavior within the CIccTagLut16::Read() function of the iccDEV library. Processing an ICC color profile that contains anomalous or malicious tag data may cause the library to access invalid memory or operate on uninitialized variables, potentially leading to memory corruption and Local Code Execution. The weakness is represented by CWE-20 (Improper Input Validation) and CWE-758 (Undefined Behavior).

The affected product is the iccDEV library, produced by the International Color Consortium. Versions earlier than 2.3.1.2 are vulnerable, including all releases that handle ICC profiles. Applications that load or parse ICC profiles using the vulnerable library are at risk.

The CVSS score is 7.1, indicating high severity. EPSS is less than 1%, suggesting a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker can supply a crafted ICC profile to the vulnerable library, either by making a user open a malicious file or through a service that automatically processes ICC data. The absence of bounds checking in CIccTagLut16::Read() makes the vulnerability exploitable locally without additional prerequisites, though successful exploitation depends on the library parsing the tainted profile.