Undefined behavior and a null pointer dereference happen when CIccTagXmlSegmentedCurve::ToXml() processes user-controlled data. The defect arises during the conversion of an ICC profile segment to XML, allowing a crafted profile to cause unpredictable execution paths. The consequence is a denial of service, data corruption, or, in some scenarios where the library passes control to external code, arbitrary code execution.

International Color Consortium iccDEV versions 2.3.1.1 and prior are affected. The vulnerability is triggered by malformed ICC profile files or other binary blobs that incorporate unsanitized input, impacting any application that utilizes iccDEV for color profile handling such as image editors, print drivers, or similar utilities. The issue is resolved in release 2.3.1.2.

The CVSS base score of 7.1 indicates high severity, yet the EPSS score is below 1%, suggesting that exploitation has a low current probability and the vulnerability is not listed in CISA’s known exploited vulnerabilities catalog. Exploitation is likely limited to environments where an attacker can supply or influence ICC profile data processed by iccDEV, potentially requiring local or application-level access. The risk to affected systems is significant because malformed input can trigger a crash or enable code execution depending on how the library interacts with application callbacks.