A critical vulnerability in the International Color Consortium iccDEV library allows unauthenticated attackers to trigger undefined behavior and code execution through maliciously crafted ICC profiles.

The flaw resides in the CIccProfileXml::ParseBasic() function, which fails to properly validate user-controllable input within structured binary blobs. This leads to null pointer dereferences and undefined behavior, which can be leveraged by an unauthenticated attacker to manipulate data, disrupt services, or achieve remote code execution.

Successful exploitation of this vulnerability poses a significant risk to organizational integrity and system availability. By injecting malicious ICC profile data, an attacker could compromise the application logic, leading to unauthorized data manipulation or potential arbitrary code execution, which justifies the CVSS score of 7.1. This vulnerability could be particularly damaging for systems that automatically process image data or color management profiles from untrusted sources.

Immediate Action: Update the iccDEV library to version 2.3.1.2 or later to incorporate the necessary input validation fixes.

Proactive Monitoring: Review application logs for unexpected crashes or errors originating from the iccDEV library components, particularly during image processing or profile parsing tasks.

Compensating Controls: Implement strict input validation and sanitization for all ICC profile data before it is passed to the library for processing to prevent the injection of malicious blobs.

Public Exploit Available: Unknown

Given the potential for code execution and the severity of the identified memory corruption flaws, organizations utilizing the iccDEV library must prioritize patching. Update all instances of the library to version 2.3.1.2 immediately to neutralize the threat. Failure to patch may expose systems to sophisticated attacks targeting the parsing logic of color management profiles.