The iccDEV library contains a constructor that triggers undefined behavior when creating a curve tag. This flaw, classified as "Undefined Behavior" and "Improper Input Validation", can cause memory corruption. An attacker who controls the ICC profile data may manipulate the library to execute arbitrary code or crash the application. The vulnerability does not directly mandate denial of service but can be leveraged for exploitation given its high severity.

International Color Consortium’s iccDEV library versions prior to 2.3.1.2 are vulnerable. Any software that incorporates this library to read or write ICC profiles from user-supplied data is affected. The patch was incorporated in version 2.3.1.2; newer releases are considered secure.

The CVSS score of 7.1 marks this issue as high impact, yet the EPSS score of less than 1% indicates exploitation is currently rare. The vulnerability is not listed in the KEV catalog. Attackers could exploit it by crafting malicious ICC profiles that are processed by applications using iccDEV, potentially leading to memory corruption, arbitrary code execution, or service disruption.