A crafted ICC profile triggers a segmentation fault within iccDEV’s CIccTagArray::Cleanup() routine, causing the process to crash when the iccRoundTrip tool parses the malicious profile. The flaw arises from misaligned member access and pointer loads that culminate in an invalid read. Because the vulnerability results in an application crash rather than code execution, its principal impact is denial of service, potentially disrupting any software that relies on iccDEV for color‑profile handling.

The International Color Consortium’s iccDEV library, versions prior to 2.3.1.6, is affected. Any system that processes third‑party ICC profiles—such as photo editing, printing, or color‑management applications—can experience crashes when encountering a malicious profile.

This vulnerability carries a CVSS score of 6.2, indicating moderate severity. Exploreability of the flaw is likely through any client that accepts ICC profiles, either from an external source or local user. The attacker can supply a malicious profile to a vulnerable application to force a crash. Since no exploit has been publicly disclosed and the flaw does not lead to code execution, the risk is limited to service interruption rather than a complete compromise.