High severity · published Apr 18, 2026
CVE-2026-41254
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LC
little cms color engine · littlecms
through 2.18 · source: vendor
LC
Little Cms · Littlecms
through 2.18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41254
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41254
Exploit
https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/
Patch
https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0
Patch
https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc
Broken Link
https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq
Mailing List
https://www.openwall.com/lists/oss-security/2026/04/17/16
lists.debian.org
https://lists.debian.org/debian-lts-announce/2026/05/msg00014.html
More from little cms color engine
9.8
CVE-2013-7455
Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a…
7.1
CVE-2016-10165
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted…
5.5
CVE-2018-16435
Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData…
4.0
CVE-2026-42798
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c
–
CVE-2013-4160
Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via…