A high-severity denial of service vulnerability in the International Color Consortium iccDEV library allows unauthenticated attackers to crash affected applications via a malformed ICC profile.

The software contains an infinite loop flaw within the IccProfile.cpp file, specifically inside the CalcProfileID function. This vulnerability can be triggered by an unauthenticated attacker, resulting in excessive resource consumption and service termination.

Successful exploitation of this flaw leads to a denial of service, which can cause significant operational disruption for any system relying on iccDEV for color profile management. Given the CVSS score of 7.5, this vulnerability represents a high risk to availability, potentially rendering critical image processing or display management services unresponsive until the application is manually restarted.

Immediate Action: Update the iccDEV library to version 2.3.1.1 or later to implement the fix for the infinite loop condition.

Proactive Monitoring: Monitor system logs and process resource utilization for sudden spikes in CPU usage or application crashes associated with ICC profile processing tasks.

Compensating Controls: Implement strict input validation or file sandboxing for any uploaded or external ICC profiles to prevent the processing of malicious or malformed data that could trigger the vulnerable code path.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a clear risk to system availability through potential resource exhaustion. Organizations should prioritize updating the iccDEV library to version 2.3.1.1 across all affected environments immediately to eliminate the exposure and prevent denial of service attacks.