This vulnerability arises from an undefined behavior in iccDEV’s XML parsing routine, where NaN floating‑point values are converted to unsigned short integer types without proper checks. The lack of validation allows memory structures to be corrupted, which in turn can lead to arbitrary code execution. The weakness is characterized by multiple CWE entries (CWE‑20, CWE‑681, CWE‑704).

Applications that rely on the International Color Consortium’s iccDEV library, particularly those that process ICC color profiles, are affected. Any deployment using iccDEV versions earlier than 2.3.1.2 is vulnerable. The fix is incorporated starting with version 2.3.1.2; later releases carry the same patch.

With a CVSS score of 7.8, the vulnerability is deemed high severity, but the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to deliver a crafted ICC profile that includes NaN values to the target application, a scenario that is feasible when the library is used to process user‑supplied color data. Because the issue originates in a runtime conversion, exploitation can occur without special privileges, making the risk significant for software that accepts external ICC profiles.