A null pointer dereference vulnerability in International Color Consortium iccDEV prior to version 2.3.1.5 poses a denial of service risk to systems processing malicious ICC color profiles.

The flaw exists within the CIccTagXmlStruct::ParseTag function, where improper handling of input leads to a null pointer dereference. This condition can be triggered by an unauthenticated attacker providing a specially crafted ICC profile, resulting in a segmentation fault or a complete denial of service.

The vulnerability carries a CVSS score of 7.8, reflecting its potential to disrupt critical services that rely on color profile management libraries. A successful exploit can cause application crashes, leading to system downtime and potential operational disruption for workflows dependent on image processing or document rendering.

Immediate Action: Upgrade the iccDEV library to version 2.3.1.5 or later to incorporate the vendor-provided fix.

Proactive Monitoring: Monitor system logs for repeated segmentation faults or application crashes associated with image processing or color management tasks.

Compensating Controls: Implement input validation on files processed by iccDEV and restrict the processing of untrusted ICC profiles until the software can be updated.

Public Exploit Available: No (exploit_available: false)

Given the severity of potential service interruptions, organizations utilizing the iccDEV library should prioritize the update to version 2.3.1.5. Testing the patch in a development environment is recommended to ensure compatibility with existing color management workflows before full-scale deployment.