CVE-2026-41254

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-696 CWE-190

Affected software

Vendor	Product	Versions
littlecms	little cms color engine	<= 2.18

References

https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/Exploit, Third Party Advisory
https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0Patch
https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bcPatch
https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qqBroken Link
https://www.openwall.com/lists/oss-security/2026/04/17/16Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2026/05/msg00014.html

Timeline

Published: Apr 18, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-412556.1CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the view CVE-2026-412565.5jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embed CVE-2026-412575.5jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When CVE-2026-412589.1OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.CVE-2026-412597.5Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricti CVE-2026-41264.3The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0 via the 'CVE-2026-412624.3Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint (GET /api/CVE-2026-412633.7Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulner CVE-2026-412649.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the CVE-2026-412659.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the CVE-2026-412667.5Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep CVE-2026-412679.8Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON i