The flaw is a segmentation fault caused by an invalid or wild pointer read within CIccCalculatorFunc::ApplySequence(), which results in the process crashing and causing a denial of service. This type of out‑of‑bounds read is classified as CWE‑125 and can be triggered when the function processes malformed or unexpected data.

International Color Consortium’s iccDEV libraries and tools, specifically all releases prior to version 2.3.1.5. The fix was introduced in release 2.3.1.5 and later, making those newer iterations safe from the fault.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1% reflects a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. While the exact attack vector is not detailed in the advisory, it is inferred that the fault would be exercised when the vulnerable function is invoked, potentially through loading a crafted ICC profile or otherwise providing unexpected data to the library. This suggests that attackers with local or application‑level access could trigger the crash, leading to service interruption.