Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0 Patch
- https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · littlecmsNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:littlecms:little_cms:*:*:*:*:*:*:*:*
References 6
- https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/ Exploit, Third Party Advisory
- https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0 Patch
- https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc Patch
- https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq Broken Link
- https://www.openwall.com/lists/oss-security/2026/04/17/16 Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2026/05/msg00014.html