iccDEV is a collection of libraries and tools for working with ICC color management profiles. A crafted ICC profile can trigger an undefined behavior condition in IccUtil.cpp when iccDumpProfile is executed. Marked as CWE‑758, the resulting undefined behavior can corrupt memory or cause unpredictable execution flows, potentially leading to a crash or arbitrary code execution within the process that runs the tool.

The vulnerability affects users of the International Color Consortium’s iccDEV library who are running versions older than 2.3.1.6. The issue was fixed in version 2.3.1.6 and later releases; any environment that processes ICC profiles with iccDumpProfile on untrusted input remains at risk.

The CVSS score of 6.2 indicates moderate risk, but EPSS data is unavailable, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog, implying no publicly documented exploits. An attacker could exploit the undefined behavior by furnishing a malicious ICC profile to a system that runs iccDumpProfile, which might be possible remotely if the tool is exposed or locally when privileged users have access. While no exploit has been reported, the undefined behavior represents a potential path to arbitrary code execution or denial of service.