{"id":"CVE-2026-41254","details":"Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.","aliases":["BIT-java-2026-41254","BIT-java-min-2026-41254","BIT-jre-2026-41254","GHSA-4xp6-rcgg-m9qq"],"modified":"2026-08-21T22:26:54.287374275Z","published":"2026-04-18T06:43:13.741Z","related":["ALSA-2026:42877","ALSA-2026:42887","ALSA-2026:42895","ALSA-2026:42899","CGA-m32r-5whf-627m","SUSE-SU-2026:22070-1","SUSE-SU-2026:22506-1","SUSE-SU-2026:22944-1","SUSE-SU-2026:22953-1","SUSE-SU-2026:3284-1","SUSE-SU-2026:3331-1","SUSE-SU-2026:3332-1","SUSE-SU-2026:3406-1","SUSE-SU-2026:3453-1","SUSE-SU-2026:3614-1","SUSE-SU-2026:3615-1","SUSE-SU-2026:3622-1","SUSE-SU-2026:3623-1","openSUSE-SU-2026:11335-1","openSUSE-SU-2026:11336-1","openSUSE-SU-2026:11362-1","openSUSE-SU-2026:11363-1","openSUSE-SU-2026:11453-1","openSUSE-SU-2026:11485-1","openSUSE-SU-2026:11486-1","openSUSE-SU-2026:11488-1","openSUSE-SU-2026:11489-1","openSUSE-SU-2026:21202-1","openSUSE-SU-2026:21440-1","openSUSE-SU-2026:21467-1","openSUSE-SU-2026:21470-1"],"database_specific":{"cwe_ids":["CWE-696"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41254.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/05/msg00014.html"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/04/17/16"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41254.json"},{"type":"ADVISORY","url":"https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41254"},{"type":"FIX","url":"https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0"},{"type":"FIX","url":"https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mm2/little-cms","events":[{"introduced":"0"},{"fixed":"da6110b1d14abc394633a388209abd5ebedd7ab0"},{"fixed":"e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"2.18"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:littlecms:little_cms:*:*:*:*:*:*:*:*"}}],"versions":["lcms2.18","lcms2.18rc_1","lcms2.17","lcms2.17rc0","lcms2.16rc1","lcm2.16rc1","lcms2.15","lcms2.15rc1","lcms2.13.1","lcms2.13","lcms2.13rc1","lcms2.12","2.12","lcms2.12rc2","lcms2.12rc1","2.11","lcms2.10","lcms2.10rc1","lcms2.9","lcms2.9rc1","lcms2.8","lcms2.8rc2","lcms2.7rc3","lcms2-2.7","lcms2.7rc2","lcms2.7rc1","lcms2.6","lcms2.6rc3","lcms2.6rc1","lcms2.6rc0","lcms2.5","lcms2.5rc3","lcms2.5rc2","lcms2.5rc1","lcms2.4","lcms2.4rc2","lcms2.4rc1","lcms2.3","lcms2.3rc3","lcms2.3rc2","lcms2.3rc1","lcms2.2","lcms2.2rc2","lcms2.2rc1","lcms2.2rc0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41254.json","vanir_signatures_modified":"2026-08-12T16:24:12Z","vanir_signatures":[{"target":{"function":"CubeSize","file":"src/cmslut.c"},"deprecated":false,"digest":{"function_hash":"151103996905205333487280703804498013001","length":313},"id":"CVE-2026-41254-0826429d","signature_type":"Function","signature_version":"v1","source":"https://github.com/mm2/little-cms/commit/da6110b1d14abc394633a388209abd5ebedd7ab0"},{"deprecated":false,"digest":{"function_hash":"328600515102910444951326586914541193561","length":329},"id":"CVE-2026-41254-0fc03b9f","signature_type":"Function","signature_version":"v1","source":"https://github.com/mm2/little-cms/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc","target":{"file":"src/cmslut.c","function":"CubeSize"}},{"signature_version":"v1","source":"https://github.com/mm2/little-cms/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc","target":{"file":"src/cmslut.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["2166842311799854057066400903572642192","73880722182175798664018837267178850914","92784381424835445787713103799084981739","245945994391277991013205265820686163302","113779849581051347427211404560983366267","52582969683582016743840494390956449804"]},"id":"CVE-2026-41254-3093fb80","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/mm2/little-cms/commit/da6110b1d14abc394633a388209abd5ebedd7ab0","target":{"file":"src/cmslut.c"},"deprecated":false,"digest":{"line_hashes":["34304708872578304858411580890683999585","140958089450064865783575510356199293505","231579098774124449854180750500904138080","52862325865801370546975363745875812216"],"threshold":0.9},"id":"CVE-2026-41254-9c3577e2"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"}]}