CVE-2026-41254
Description
A flaw was found in Little CMS. An integer overflow in the CubeSize function within cmslut.c occurs because the overflow check is performed after the multiplication. An attacker could exploit this vulnerability by providing a specially crafted input, potentially leading to information disclosure or a denial of service (DoS), which makes the system unavailable to legitimate users.
Statement
This Moderate flaw in Little CMS (lcms2) involves an integer overflow within the CubeSize function, occurring due to an insufficient check during multiplication. Processing specially crafted color profiles or image data could lead to information disclosure or a denial of service, affecting the availability of applications that rely on lcms2 for color management. Exploitation requires user interaction with malicious content.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | 7.5 | 4 |
| Attack Vector | Local | Network | Local |
| Attack Complexity | Low | Low | High |
| Privileges Required | None | None | None |
| User Interaction | Required | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | Low | None | Low |
| Integrity Impact | None | None | None |
| Availability Impact | High | High | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
