The vulnerability is a null pointer dereference in CIccTagXmlStruct::ParseTag(), leading to a segmentation fault or denial of service. This flaw is a classic NULL dereference vulnerability (CWE-476) that can be triggered when processing malformed ICC tags. It directly disrupts the stability of any application using iccDEV, potentially causing a crash but not leaking information or allowing code execution.

International Color Consortium's iccDEV in any installation older than version 2.3.1.5 is affected. The malfunction occurs in the library component that parses ICC tags prior to the 2.3.1.5 release.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% suggests exploitation is unlikely but possible if adversaries control ICC profile input. Based on the description, the likely attack vector involves feeding a crafted ICC profile that triggers the null dereference during parsing, which causes a crash of the host process. The vulnerability is not listed in the CISA KEV catalog at this time, further suggesting a lower current threat level. Nonetheless, the potential for denial of service warrants prompt mitigation.