CVE-2026-41254 Details
Description
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
A check-after-multiply integer overflow vulnerability has been identified in Little CMS (lcms2) versions through 2.18. The issue arises in the CubeSize function within the file cmslut.c. The vulnerability occurs because the overflow check is performed after the multiplication, allowing crafted ICC profiles with five or more CLUT channels to exploit the flaw. This leads to a heap-based buffer overflow during interpolation, causing applications to crash.
Users can upgrade to Little CMS version 2.18 or later, where this vulnerability has been fixed. For OpenJDK users on Windows, upgrading to a version that does not bundle the vulnerable lcms.dll is recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-696 | Incorrect Behavior Order | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| littlecms little cms | <= 2.18 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | CVE Modified | CVE |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 18, 2026 | New CVE Received | [email protected] |