A critical input validation flaw in the International Color Consortium iccDEV library allows unauthenticated remote attackers to trigger denial of service or arbitrary code execution.

The vulnerability stems from improper input validation (CWE-20) and NULL pointer dereference issues within the CIccTagXmlSegmentedCurve::ToXml function. An unauthenticated attacker can supply malicious input to trigger undefined behavior, potentially resulting in system crashes or unauthorized code execution.

Successful exploitation poses a significant risk to operational continuity and system integrity. Because the library processes ICC profiles, an attacker could achieve remote code execution or manipulate data, leading to a total compromise of the host application. With a CVSS score of 7.1, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized access or service disruption.

Immediate Action: Update the iccDEV library to version 2.3.1.2 or later, which contains the necessary security fixes for the identified input validation flaws.

Proactive Monitoring: Review application logs for unexpected crashes or error patterns related to ICC profile processing, as these may indicate attempts to trigger the NULL pointer dereference.

Compensating Controls: Implement input sanitization and strict validation schemas at the application layer to ensure that only well-formed ICC profile data is passed to the iccDEV library.

Public Exploit Available: No (exploit_available: unknown)

The vulnerability in iccDEV represents a substantial risk to applications that handle ICC color management profiles. Organizations should prioritize the update to version 2.3.1.2 across all development and production environments to remediate this flaw. Failure to patch may expose systems to remote code execution or denial of service attacks originating from malicious profile files.