Integer Overflow Vulnerability in Little CMS by mm2

CVE-2026-41254

What is CVE-2026-41254?

The vulnerability in Little CMS 2.18 is an integer overflow that occurs within the CubeSize function of the cmslut.c file. The issue arises because the overflow check takes place after the multiplication operation, leading to potential incorrect calculations. This flaw could be exploited to compromise the integrity of data processing within applications leveraging Little CMS for color management. Users are advised to apply the necessary patches to mitigate potential security risks associated with this vulnerability.

References