The issue originates from undefined behavior in the CIccTagLutAtoB::Validate function of iccDEV. When a profile is processed, the function can read or write memory incorrectly, leading to unpredictable results. This could allow an attacker to corrupt configuration data, cause a crash, or potentially execute arbitrary code if the failure is exploitable in the application using the library. The affected components are the color management libraries that validate ICC profiles, which are used in graphics, imaging, and system settings directories.

Any installation of the International Color Consortium’s iccDEV library newer than version 1 but older than 2.3.1.2 that loads ICC color profiles. Common targets include graphics editors, operating system display services, and print drivers that rely on ICC profile validation.

The CVSS score of 7.1 classifies the vulnerability as high severity. The EPSS probability is very low (< 1%), suggesting exploitation attempts are rare or difficult. The vulnerability is not listed in the CISA KEV catalog, and the attack vector likely requires an attacker to supply a crafted ICC profile that is processed by an application linking to the vulnerable library. No known exploit exists at this time, but the undefined behavior creates a high potential for serious impact if abuse occurs.