Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
Weakness
The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Little_cms | Littlecms | * | 2.18 (including) |
| Lcms2 | Ubuntu | devel | * |
| Lcms2 | Ubuntu | esm-infra-legacy/trusty | * |
| Lcms2 | Ubuntu | esm-infra-legacy/xenial | * |
| Lcms2 | Ubuntu | esm-infra/bionic | * |
| Lcms2 | Ubuntu | esm-infra/focal | * |
| Lcms2 | Ubuntu | esm-infra/xenial | * |
| Lcms2 | Ubuntu | jammy | * |
| Lcms2 | Ubuntu | noble | * |
| Lcms2 | Ubuntu | questing | * |
| Lcms2 | Ubuntu | resolute | * |
Related Attack Patterns
References
- https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/
- https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0
- https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc
- https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq
- https://www.openwall.com/lists/oss-security/2026/04/17/16
- https://lists.debian.org/debian-lts-announce/2026/05/msg00014.html