CVE-2026-41254

תיאור (מקור, אנגלית)

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

מדדים

CVSS 3.1

7.5 (HIGH) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-28/7/2026

CWE

CWE-696, CWE-190

מוצרים מושפעים

littlecms: little cms

קישורים

• https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7‮… Patch
• https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd‮… Patch
• https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/ ExploitThird Party Advisory
• https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq Broken Link
• https://www.openwall.com/lists/oss-security/2026/04/17/16 Mailing ListThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2026/05/msg00014.html