CVE-2026-41254CWE-696

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication

Medium · published April 18, 2026

CVSS v3.1
4.0
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00364 · 29.0th percentile
Weakness
CWE-696 · Incorrect Behavior Order
Published
2026-04-18T06:43Z
EPSS history
Timeline
  • 18 APR 06:43Z
    Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication
    cvelistv5