Iccdev CVE-2026-34541

The CVSS 3.1 score of 6.2 (Medium) with vector AV:L/AC:L/PR:N/UI:N/S:U reflects local attack vector and high availability impact (crashes iccApplyNamedCmm), but zero confidentiality or integrity consequences. The low attack complexity and no privilege requirement indicate ease of exploitation by any local user able to write files. However, real-world risk is constrained by three factors: (1) attack requires local file system access to supply the malformed profile-no remote exploitation path exists; (2) impact is denial of service only (application crash), not privilege escalation or data exfiltration; (3) exploitation requires explicit use of the -PCC flag in iccApplyNamedCmm, limiting exposure to workflows that deliberately invoke profile connection condition processing. The medium CVSS score appropriately reflects that while the flaw is trivially exploitable once local access is obtained, the practical threat surface is narrow compared to network-reachable vulnerabilities or those enabling code execution.

An attacker with local access to a system running iccDEV creates a malformed ICC profile file by corrupting the spectral viewing conditions data structure to trigger a null pointer. The attacker then runs iccApplyNamedCmm -PCC malformed.icc, causing the tool to invoke the vulnerable constructor, dereference the null pointer, and crash due to undefined behavior. In a server environment where iccApplyNamedCmm is exposed through a service API that accepts user-uploaded ICC profiles, this could enable a denial-of-service attack against batch color profile processing workflows, though the local attack vector requirement significantly limits exposure compared to remote denial-of-service threats.