icSigCalcOp in iccDEV triggers undefined behavior when user‑controlled data is inserted into ICC profile blobs. The flaw can lead to denial of service, data tampering, logic bypass, and code execution in contexts where iccDEV parses those profiles. The issue is rooted in improper input validation (CWE‑20) and the resulting undefined behavior (CWE‑758).

InternationalColorConsortium’s iccDEV library version 2.3.1.1 and any earlier releases are affected. Applications that rely on this library for color management, such as image editors or print workflow tools, are susceptible when they process external ICC profiles.

The CVSS score of 7.1 indicates significant risk, while the EPSS score of less than 1% and absence from CISA’s KEV catalog suggest a low probability of exploitation. The likely attack vector involves the delivery of crafted ICC profiles to vulnerable applications that use iccDEV; an attacker could trigger denial of service or, depending on the application’s privilege context, execute code. Successful exploitation would depend on the application layer’s exposure to untrusted ICC data.