Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

published 2026-04-30 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-26351

cvss: 4.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits: 0; none known

Patch / fix

fixed in 1 distros 4 links 1

littlecms little cms color engine 2.19

debian ubuntu suse opensuse

lcms2 Debian 13 2.16-2+deb13u2
lcms2 Debian 14 2.19.1-1

debian advisories DEBIAN-CVE-2026-42798

lcms2 Ubuntu 25.10 2.16-2ubuntu0.2
lcms2 Ubuntu 26.04 LTS 2.17-1ubuntu0.2

ubuntu advisories UBUNTU-CVE-2026-42798

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

lcms2 Linux Micro 6.0 2.16-2.1
lcms2 SLES for SAP applications 16.0, SLES 16.0 2.16-160000.4.1
lcms2 Linux Micro 6.1 2.16-slfo.1.1_2.1

suse advisories SUSE-SU-2026:23443-1 SUSE-SU-2026:22506-1 SUSE-SU-2026:22070-1

lcms2 openSUSE Leap 16.0 2.16-160000.4.1

opensuse advisories openSUSE-SU-2026:21202-1

github.com/mm2/Little-CMS@6a68601 commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 6 mo ago (2026-04-30)

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.0	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

littlecms little cms color engine

Classification

Weakness

CWE-190 Integer Overflow or Wraparound

References

Sources

CVE List CVE-2026-42798
NVD CVE-2026-42798

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary