Logo
componentlcms2
Name
lcms2
Version
2.16
Type
library
Description
-
Licenses
MIT
PURL
-
CPE
cpe:2.3:a:littlecms:little_cms:2.16:-:*:*:*:*:*:*

Other Versions#


Project
Branch
Version
master
2.19.1

Patches#


#
Title
Author
Resolve
1
Fix integer overflow in CubeSize()
Marti Maria <marti.maria@littlecms.com>
CVE-2026-41254
2
check for overflow
Marti Maria <marti.maria@littlecms.com>
CVE-2026-41254
3
Fix for ParseCube integer overflow in LUT allocation
Marti Maria <marti.maria@littlecms.com>
CVE-2026-42798

Vulnerabilities#


Name
Analysis
Description
Patched
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.
Patched
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.