The flaw is a heap‑use‑after‑free in the iccDEV library’s CIccCmm::AddXform() function, which can cause a program to dereference a freed object and crash. The advisory reports only an application terminate scenario, so the documented impact is a denial‑of‑service condition. No evidence of code execution or privilege escalation is provided, so the impact remains limited to service disruption.

International Color Consortium’s iccDEV libraries and tools before version 2.3.1.5 are vulnerable. Any deployment that uses these earlier releases, particularly those that invoke CIccCmm::AddXform(), is affected.

The CVSS score of 7.8 indicates a high severity, but the EPSS score of less than 1% suggests a very low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. The advisory does not describe a successful exploit path; therefore, it appears to be an internal crash rather than an externally exploitable payload. Attackers would need to supply input that triggers the AddXform() routine in a context that can manipulate the freed memory to pose a risk beyond denial of service.