CVE-2026-41254
EUVD-2026-2366818.04.2026, 07:16
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| littlecms | little_cms | 𝑥 ≤ 2.18 |
𝑥
= Vulnerable software versions
Debian Releases
Amazon Linux Releases
Amazon Package | |||||
|---|---|---|---|---|---|
| lcms2 |
| ||||
| lcms2-debuginfo |
| ||||
| lcms2-debugsource |
| ||||
| lcms2-devel |
| ||||
| lcms2-utils |
| ||||
| lcms2-utils-debuginfo |
|
Common Weakness Enumeration
- CWE-696 - Incorrect Behavior OrderThe product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses.
- CWE-190 - Integer Overflow or WraparoundThe software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.
References