CVE-2026-41254

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.4 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/	Exploit Third Party Advisory
https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0	Patch
https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc	Patch
https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq	Broken Link
https://www.openwall.com/lists/oss-security/2026/04/17/16	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2026/05/msg00014.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:littlecms:little_cms:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Little CMS (lcms2) hasta la versión 2.18 tiene un desbordamiento de entero en CubeSize en cmslut.c porque la comprobación de desbordamiento se realiza después de la multiplicación.

Information

Published : 2026-04-18 07:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-41254

Mitre link : CVE-2026-41254

CVE.ORG link : CVE-2026-41254

JSON object : View

Products Affected

littlecms

little_cms

CWE

CWE-696

Incorrect Behavior Order

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-41254", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41254", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:09:17.782302Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.4}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "littlecms", "product": "little cms color engine", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.18"}], "defaultStatus": "unknown"}]}], "published": "2026-04-18T07:16:10.807", "references": [{"url": "https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2026/04/17/16", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00014.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-696"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication."}, {"lang": "es", "value": "Little CMS (lcms2) hasta la versi\u00f3n 2.18 tiene un desbordamiento de entero en CubeSize en cmslut.c porque la comprobaci\u00f3n de desbordamiento se realiza despu\u00e9s de la multiplicaci\u00f3n."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:littlecms:little_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "164F4271-DB64-42AB-96AA-17A9112CB34A", "versionEndIncluding": "2.18"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}