iccDEV Undefined Behavior Vulnerability Leading to Runtime Error

A vulnerability in the iccDEV library, affecting versions prior to 2.3.1.2, allows for undefined behavior that results in a runtime error. This issue arises when processing International Color Consortium (ICC) color profiles, where certain invalid numeric values, such as NaN (Not a Number), can cause the application to crash. The vulnerability requires user interaction to be exploited.

Impact

Exploitation of this vulnerability causes a runtime error, with the application crashing after displaying a warning about an invalid numeric value. This issue disrupts the normal operation of the software, particularly when handling ICC color profiles.

Remediation

Users can upgrade to iccDEV version 2.3.1.2 or later, where this vulnerability has been patched.