CVE-2026-42798

MediumCVSS 4.0

Published: 30/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

Little CMS (lcms2) versions 2.16 through 2.18 before 2.19 contain an integer overflow in ParseCube in cmscgats.c.

Risk Assessment

The integer overflow during file processing may lead to memory errors, crashes, or potentially other impacts depending on the processing context. The risk applies to applications processing untrusted files with lcms2.

Recommendation

Update Little CMS (lcms2) to version 2.19 or later. Until then, avoid processing untrusted files with applications using lcms2.

Other vulnerabilities in Little CMS (lcms2)

CVE-2016-10165High
The Type_MLU_Read function in cmstypes.c in Little CMS (lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, leading to an out-of-bounds heap read.

Original NVD description (English source)

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS