The defect in iccDEV’s CIccCLUT::Iterate() and the CLUT dumping logic used by CIccMBB::Describe() can cause the library to consume excessive resources or crash, leading to a denial of service. This vulnerability is classified under CWE‑562 and CWE‑665, indicating issues with resource management and buffer handling. The impact is a loss of availability for any application that processes ICC profiles using these functions.

International Color Consortium’s iccDEV library in all versions prior to 2.3.1.6. The affected code resides in the CIccCLUT::Iterate() function and the CLUT dumping path of CIccMBB::Describe(). Any system that loads or processes ICC profiles with a vulnerable version of iccDEV is at risk.

The CVSS score of 4.0 indicates a medium to low severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote, depending on how the application uses iccDEV; an attacker could trigger the DoS by supplying crafted ICC profile data that exercises the vulnerable logic. Because exploitation requires the library to be loaded and the specific code path to be invoked, the overall risk remains moderate. Prompt remediation is still recommended due to the availability impact.