iccDEV contains a stack overflow vulnerability in the CIccBasicStructFactory::CreateStruct() function. The flaw causes uncontrolled recursion and stack exhaustion, leading to a crash. This is a classic stack overflow (CWE-121) coupled with resource exhaustion (CWE-400) and improper control flow handling (CWE-674). The primary impact is a denial of service as the error terminates the process that is handling ICC profiles.

The issue affects the International Color Consortium’s iccDEV library and associated tools on all versions released prior to 2.3.1.5. Version 2.3.1.5 and later include the fix, removing the vulnerable recursion path.

CVSS indicates a moderate severity of 5.5, while the EPSS score is below 1%, implying a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require an attacker to supply a specially crafted ICC profile or otherwise trigger the recursive parsing path in a context where the library is loaded, which may be limited to environments that dynamically process ICC data. Given the low exploitation probability and the nature of the crash, the risk remains primarily a local denial of service rather than a remote code execution vector.