A vulnerability exists in the iccDEV library, wherein the function CIccCalculatorFunc::ApplySequence() can perform undefined behavior when processing an ICC profile that contains invalid enum values for icChannelFuncSignature. Because the library interprets these values incorrectly, the program may crash or behave unpredictably during color profile calculation. The underlying weakness is a type/enum value confusion, classified as CWE-758.

This flaw affects the International Color Consortium’s iccDEV suite for all versions released before 2.3.1.6. A user who loads a malicious or malformed ICC profile—such as one that has been specially crafted to exploit the enum mishandling—would trigger the undefined behavior.

The CVSS base score is 6.2, indicating medium severity. No EPSS score is reported, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that widespread exploitation has not been observed. Attackers could potentially cause a denial‑of‑service or, if additional vulnerabilities exist, execute arbitrary code by feeding the affected software with a crafted ICC profile. The risk is primarily through any application that automatically consumes ICC profiles, so the attack vector is inferred to be local or remote file upload, depending on the context of the consuming software.