The vulnerability is an undefined behavior triggered during XML conversion when a negative signed integer is implicitly converted to an unsigned 32‑bit value. This type mismatch alters the resulting value and can lead to incorrect XML output or program instability, potentially causing a crash or denial of service when the iccToXml tool processes malformed inputs.

All installations of International Color Consortium's iccDEV that use a version earlier than 2.3.1.6 are susceptible. The flaw resides in the iccUTIL XML conversion component, part of the library and associated command‑line tools that convert ICC profiles to XML format.

The CVSS score of 6.2 indicates moderate severity. No EPSS data is available and the issue is not listed in CISA's KEV catalog. The flaw is triggered by feeding malicious or malformed data to the iccToXml conversion path, which is a local or potentially remote entry point if the tool is exposed to untrusted input. Because the exploit requires exploiting undefined behavior, practical attack construction may be complex, but the possibility of a crash or loss of data integrity warrants prompt attention.