Technical impact
The vulnerability arises in the ICC Color Management library iccDEV. A crafted TIFF file can trigger undefined behaviour in the code that handles TIFF data, specifically a division by zero in the TiffImg.h component. This issue allows an attacker to cause the iccTiffDump tool or any application that relies on the library to crash, resulting in service disruption. The weakness falls under CWE-369, a division by zero, and may also provide a foothold for more severe exploitation if the crash leads to memory corruption.
Affected Systems
Affected products are the International Color Consortium's iccDEV libraries and tools on all operating systems supported by the library, for versions earlier than 2.3.1.6. Users of older releases that process TIFF files with iccTiffDump or integrated library calls are vulnerable until upgraded to 2.3.1.6 or newer.
Risk and Exploitability
The CVSS base score of 6.2 indicates a moderate severity. No EPSS score is available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Attacks would require an ability to supply malformed TIFF data to the library, either locally or remotely depending on the application context. No official workaround is listed; the only reliable protection is applying the patched version.
