Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize

🗓️ 23 Jul 2026 11:34:04Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 8 Views

Integer overflow in Little CMS CubeSize after multiplication risks disclosure or denial of service.

Reporter	Title	Published	Views	Family All 231
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM® SDK Java™ Technology Edition shipped with IBM Tivoli Monitoring.	13 Aug 202620:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Service Registry and Repository due to July 2026 CPU	10 Aug 202616:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU	4 Aug 202606:13	–	ibm
IBM Security Bulletins	Security Bulletin: Updating Java in Identity Insight 10.0.0.0 for security update	13 Aug 202621:16	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent	19 Aug 202614:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition for IBM Content Collector for SAP Applications	12 Aug 202608:04	–	ibm
IBM Security Bulletins	Security Bulletin: Updating Java in Identity Insight 9.0.0.1 for security update	14 Aug 202616:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition	13 Aug 202616:36	–	ibm
IBM AIX	Vulnerabilities in IBM AIX and PowerVM VIOS	14 Aug 202620:25	–	aix
ATTACKERKB	CVE-2026-41254	18 Apr 202606:43	–	attackerkb

Vulners

Node

AND

redhat openjdkRange<17

redhat enterprise_linux

Source	Link
abhinavagarwal07	www.abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/
access	www.access.redhat.com/security/cve/CVE-2026-41254
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0
github	www.github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc
github	www.github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41254
cve	www.cve.org/CVERecord
openwall	www.openwall.com/lists/oss-security/2026/04/17/16

10 Aug 2026 20:33Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14 - 7.5

EPSS0.00365

SSVC

Little CMS CubeSize Cmslut Integer overflow Information disclosure Denial of service