A critical memory corruption vulnerability in the iccDEV library enables arbitrary code execution when processing malicious ICC color profiles, posing a severe risk to affected systems.

The flaw stems from improper input validation and incorrect numeric type conversion during XML parsing. When floating point NaN values are converted to unsigned short integers, it leads to undefined behavior that can corrupt memory structures, allowing an attacker to execute arbitrary code.

The potential for arbitrary code execution creates a high risk of total system compromise, including unauthorized data access and loss of system integrity. With a CVSS score of 7.8, this vulnerability is categorized as High, reflecting the significant impact on both confidentiality and availability of systems utilizing the library for image or profile processing.

Immediate Action: Update the iccDEV library to version 2.3.1.2 or later to incorporate the necessary fix for numeric type conversion.

Proactive Monitoring: Monitor application logs for segmentation faults or unexpected crashes in processes that handle ICC color profiles.

Compensating Controls: Implement strict input validation on all externally sourced ICC profiles and process untrusted files within isolated, sandboxed environments to minimize the impact of potential memory corruption.

Public Exploit Available: Unknown.

Given the potential for arbitrary code execution and the existence of proof-of-concept evidence, organizations should prioritize the update of the iccDEV library across all affected environments. Failure to patch may expose systems to remote code execution attacks triggered by the processing of malicious color profiles.