ic cDEV contains a bug in the CIccCLUT::Interp3d() routine that triggers a segmentation fault when a wild or invalid pointer is dereferenced. The resulting crash causes a denial of service by terminating the process that is handling the ICC profile. This flaw is a classic out‑of‑bounds read (CWE‑125) coupled with a use‑after‑free condition (CWE‑703).

The vulnerability affects all installations of International Color Consortium’s iccDEV library prior to version 2.3.1.5. Systems that compile or link against iccDEV, such as color management tools or imaging applications that load ICC profiles, are susceptible if they use a version older than the released patch.

The CVSS score of 5.5 places the issue in the medium severity range, and an EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The CVE is not listed in the CISA KEV catalog. The likely attack path involves an attacker supplying a malicious ICC profile that forces the vulnerable library to read an out‑of‑bounds or freed pointer, leading to a crash. No external access vector is required; exploitation is confined to the local process that loads the profile. While the impact is limited to a denial of service for that process, repeated crashes could degrade system availability, especially in high‑throughput or unattended environments.