Medium severity · published Apr 30, 2026
CVE-2026-42798
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c
4.0
CVSS
0.1%
EPSS
No
On KEV
Description
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LC
little cms color engine · littlecms
2.16 before 2.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42798
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42798
github.com
https://github.com/mm2/Little-CMS/commit/6a686019825a89b715d16671f18d049523354176
github.com
https://github.com/mm2/Little-CMS/compare/lcms2.18...lcms2.19
www.openwall.com
https://www.openwall.com/lists/oss-security/2026/04/30/8
More from little cms color engine
9.8
CVE-2013-7455
Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a…
7.5
CVE-2026-41254
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication
7.1
CVE-2016-10165
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted…
5.5
CVE-2018-16435
Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData…
–
CVE-2013-4160
Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via…