Technical impact
The flaw is caused by unsafe handling of XML data in CIccTagXmlFloatNum's ParseXml method, leading to undefined behavior and null pointer dereference. The effect can be a program crash or manipulation of data and bypass of application logic, giving an attacker denial‑of‑service, data tampering, or potentially arbitrary code execution. The listed CWEs reflect input validation weaknesses and null pointer usage.
Affected Systems
All installations of InternationalColorConsortium's iccDEV library that are at or below version 2.3.1.1 are vulnerable, regardless of the host platform or usage scenario. Versions 2.3.1.2 and later include the fix and are safe.
Risk and Exploitability
The base CVSS score of 7.1 indicates a medium‑to‑high risk. The EPSS score of less than 1% suggests that exploitation opportunities are currently uncommon, and the vulnerability is not yet listed in the CISA KEV catalog. Nevertheless, the attack surface is active: a crafted ICC profile or other structured binary blob can trigger the parsing routine. Successful exploitation could crash the process or, in constrained environments where memory corruption is exploitable, lead to code execution. Therefore, the vulnerability should be considered exploitable by attackers with sufficient persistence and motivation.
