A heap-use-after-free vulnerability in the International Color Consortium iccDEV library, version 2.3.1.4 and earlier, poses a significant risk of arbitrary code execution or service disruption.

The vulnerability is a heap-use-after-free flaw located in the CIccCmm::AddXform function. An unauthenticated attacker can trigger this issue by providing a specially crafted ICC color profile, leading to an invalid vptr dereference.

The exploitation of this memory corruption vulnerability can lead to system crashes or potentially remote code execution. Given the CVSS score of 7.8, the impact is considered High, as it could result in unauthorized access to sensitive data or complete loss of service availability for systems processing untrusted color profiles.

Immediate Action: Update the iccDEV library to version 2.3.1.5 or later, as provided in the official release.

Proactive Monitoring: Monitor application logs for unexpected crashes or segmentation faults occurring during the processing of ICC profile data.

Compensating Controls: If immediate patching is not feasible, restrict the processing of externally sourced or untrusted ICC profiles to isolated, low-privilege sandboxed environments.

Public Exploit Available: No (exploit_available: false)

The security of software relying on the iccDEV library should be prioritized by applying the 2.3.1.5 patch immediately. Organizations should assess their software supply chain to identify any dependencies on this library and ensure that updates are integrated into their development and deployment pipelines to mitigate the risk of memory-based attacks.