p PatchFirst

CVE-2026-41254

CVE-2026-41254

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

CVSS 4.0 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • little cms color engine

    Versions
    • ≥ 0, ≤ 2.18: Affected (custom)

    No fix published

  • lcms2 Debian:12

    Versions
    • 2.14-2
    Affected ranges
    • ECOSYSTEM: < 2.14-2+deb12u1

    Update to 2.14-2+deb12u1

  • lcms2 Debian:13

    Versions
    • 2.16-2
    • 2.16-2+deb13u1
    Affected ranges
    • ECOSYSTEM: < 2.16-2+deb13u2

    Update to 2.16-2+deb13u2

  • lcms2 Debian:14

    Versions
    • 2.16-2
    • 2.17-1
    Affected ranges
    • ECOSYSTEM: < 2.17-1.1

    Update to 2.17-1.1

  • openjdk-17 Debian:12

    Versions
    • 17.0.10+7-1
    • 17.0.10+7-1~deb11u1
    • 17.0.10+7-1~deb12u1
    • 17.0.10+7-2
    • 17.0.10+7-3
    • 17.0.10~6ea-1
    • 17.0.11+9-1
    • 17.0.11+9-1~deb11u1
    • 17.0.11+9-1~deb12u1
    • 17.0.11~6ea-1
    • 17.0.11~7ea-1
    • 17.0.12+7-1
    • 17.0.12+7-2
    • 17.0.12+7-2~deb11u1
    • 17.0.12+7-2~deb12u1
    • 17.0.12~6ea-1
    • 17.0.13+11-1
    • 17.0.13+11-1~deb11u1
    • 17.0.13+11-1~deb12u1
    • 17.0.13+11-2
    • 17.0.13+11-2~deb12u1
    • 17.0.13~6ea-1
    • 17.0.14+7-1
    • 17.0.14+7-1~deb11u1
    • 17.0.14+7-1~deb12u1
    • 17.0.14~6ea-1
    • 17.0.15+6-1
    • 17.0.15+6-1~deb11u1
    • 17.0.15+6-1~deb12u1
    • 17.0.15~4ea-1
    • 17.0.15~5ea-1
    • 17.0.16+8-1
    • 17.0.16+8-1~deb11u1
    • 17.0.16+8-1~deb12u1
    • 17.0.16~5ea-1
    • 17.0.17+10-1
    • 17.0.17+10-1~deb11u1
    • 17.0.17+10-1~deb12u1
    • 17.0.17~5ea-1
    • 17.0.17~8ea-1
    • 17.0.18+8-1
    • 17.0.18+8-1~deb11u1
    • 17.0.18+8-1~deb12u1
    • 17.0.18~7ea-1
    • 17.0.19+10-1
    • 17.0.19+10-1~deb11u1
    • 17.0.19+10-1~deb12u1
    • 17.0.19+10-1~deb12u2
    • 17.0.19~6ea-1
    • 17.0.19~9ea-1
    • 17.0.19~9ea-2
    • 17.0.20+8-1~deb11u1
    • 17.0.20~5ea-1
    • 17.0.20~7ea-1
    • 17.0.6+10-1
    • 17.0.7+7-1
    • 17.0.7+7-1~deb11u1
    • 17.0.7+7-1~deb12u1
    • 17.0.7+7-2
    • 17.0.8+7-1
    • 17.0.8+7-1~deb12u1
    • 17.0.8~6-1
    • 17.0.8~6-2
    • 17.0.8~6-3
    • 17.0.8~6-4
    • 17.0.8~6-5
    • 17.0.9+9-1
    • 17.0.9+9-1~deb11u1
    • 17.0.9+9-1~deb12u1
    • 17.0.9+9-2
    • 17.0.9~4ea-1
    • 17.0.9~6ea-1
    Affected ranges
    • ECOSYSTEM: < 17.0.20+8-1~deb12u1

    Update to 17.0.20+8-1~deb12u1

  • openjdk-21 Debian:13

    Versions
    • 21.0.10+7-1
    • 21.0.10+7-1~deb13u1
    • 21.0.10~4ea-1
    • 21.0.10~6ea-1
    • 21.0.11+10-1
    • 21.0.11+10-1~deb13u1
    • 21.0.11+10-1~deb13u2
    • 21.0.11~5ea-1
    • 21.0.11~6ea-1
    • 21.0.11~8ea-1
    • 21.0.11~9ea-1
    • 21.0.11~9ea-2
    • 21.0.12~5ea-1
    • 21.0.12~7ea-1
    • 21.0.8+9-1
    • 21.0.9+10-1
    • 21.0.9+10-1~deb13u1
    • 21.0.9~5ea-1
    • 21.0.9~8ea-1
    Affected ranges
    • ECOSYSTEM: < 21.0.12+8-1~deb13u1

    Update to 21.0.12+8-1~deb13u1

  • openjdk-21 Debian:14

    Versions
    • 21.0.10+7-1
    • 21.0.10+7-1~deb13u1
    • 21.0.10~4ea-1
    • 21.0.10~6ea-1
    • 21.0.11+10-1
    • 21.0.11+10-1~deb13u1
    • 21.0.11+10-1~deb13u2
    • 21.0.11~5ea-1
    • 21.0.11~6ea-1
    • 21.0.11~8ea-1
    • 21.0.11~9ea-1
    • 21.0.11~9ea-2
    • 21.0.12+8-1~deb13u1
    • 21.0.12~5ea-1
    • 21.0.12~7ea-1
    • 21.0.8+9-1
    • 21.0.9+10-1
    • 21.0.9+10-1~deb13u1
    • 21.0.9~5ea-1
    • 21.0.9~8ea-1
    Affected ranges
    • ECOSYSTEM: < 21.0.12+8-1

    Update to 21.0.12+8-1

  • openjdk-25 Debian:13

    Versions
    • 25+36-1
    • 25.0.1+8-1
    • 25.0.1+8-1~deb13u1
    • 25.0.1+8-2
    • 25.0.1+8-3
    • 25.0.2+10-1
    • 25.0.2+10-1~deb13u2
    • 25.0.3+9-1
    • 25.0.3+9-2
    • 25.0.3+9-2~deb13u1
    • 25.0.3~5ea-1
    • 25.0.3~5ea-2
    • 25.0.3~7ea-1
    • 25.0.3~7ea-2
    • 25.0.3~8ea-1
    • 25.0.3~8ea-2
    • 25.0.4~4ea-1
    • 25.0.4~6ea-1
    • 25~32ea-1
    • 25~34ea-1
    • 25~36ea-1
    Affected ranges
    • ECOSYSTEM: < 25.0.4+7-1~deb13u1

    Update to 25.0.4+7-1~deb13u1

  • openjdk-25 Debian:14

    Versions
    • 25+36-1
    • 25.0.1+8-1
    • 25.0.1+8-1~deb13u1
    • 25.0.1+8-2
    • 25.0.1+8-3
    • 25.0.2+10-1
    • 25.0.2+10-1~deb13u2
    • 25.0.3+9-1
    • 25.0.3+9-2
    • 25.0.3+9-2~deb13u1
    • 25.0.3~5ea-1
    • 25.0.3~5ea-2
    • 25.0.3~7ea-1
    • 25.0.3~7ea-2
    • 25.0.3~8ea-1
    • 25.0.3~8ea-2
    • 25.0.4+7-1~deb13u1
    • 25.0.4~4ea-1
    • 25.0.4~6ea-1
    • 25~32ea-1
    • 25~34ea-1
    • 25~36ea-1
    Affected ranges
    • ECOSYSTEM: < 25.0.4+7-1

    Update to 25.0.4+7-1

  • openjdk-26 Debian:14

    Versions
    • 26+35-1
    • 26+35-2
    • 26+35-3
    • 26.0.1+8-1
    • 26.0.1+8-2
    • 26.0.1+8-3
    • 26.0.1+8-4
    • 26~12ea-1
    • 26~17ea-1
    • 26~21ea-1
    • 26~22ea-1
    • 26~22ea-2
    • 26~26ea-1
    • 26~28ea-1
    • 26~30ea-1
    • 26~32ea-1
    • 26~34ea-1
    • 26~35ea-1
    • 26~9ea-1
    Affected ranges
    • ECOSYSTEM: < 26.0.2+10-1

    Update to 26.0.2+10-1

  • lcms2 Ubuntu:Pro:14.04:LTS

    Versions
    • 2.5-0ubuntu1
    • 2.5-0ubuntu2
    • 2.5-0ubuntu3
    • 2.5-0ubuntu4
    • 2.5-0ubuntu4.1
    • 2.5-0ubuntu4.2
    Affected ranges
    • ECOSYSTEM: < 2.5-0ubuntu4.2+esm1

    Update to 2.5-0ubuntu4.2+esm1

  • lcms2 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.6-3ubuntu2
    • 2.6-3ubuntu2.1
    Affected ranges
    • ECOSYSTEM: < 2.6-3ubuntu2.1+esm1

    Update to 2.6-3ubuntu2.1+esm1

  • lcms2 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.7-1ubuntu1
    • 2.8-4
    • 2.9-1
    • 2.9-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 2.9-1ubuntu0.1+esm1

    Update to 2.9-1ubuntu0.1+esm1

  • lcms2 Ubuntu:Pro:20.04:LTS

    Versions
    • 2.9-4
    Affected ranges
    • ECOSYSTEM: < 2.9-4ubuntu0.1~esm1

    Update to 2.9-4ubuntu0.1~esm1

  • lcms2 Ubuntu:22.04:LTS

    Versions
    • 2.12~rc1-2
    • 2.12~rc1-2build1
    • 2.12~rc1-2build2
    Affected ranges
    • ECOSYSTEM: < 2.12~rc1-2ubuntu0.1

    Update to 2.12~rc1-2ubuntu0.1

  • lcms2 Ubuntu:24.04:LTS

    Versions
    • 2.14-2
    • 2.14-2build1
    Affected ranges
    • ECOSYSTEM: < 2.14-2ubuntu0.1

    Update to 2.14-2ubuntu0.1

  • lcms2 Ubuntu:25.10

    Versions
    • 2.16-2
    Affected ranges
    • ECOSYSTEM: < 2.16-2ubuntu0.1

    Update to 2.16-2ubuntu0.1

  • lcms2 Ubuntu:26.04:LTS

    Versions
    • 2.16-2
    • 2.17-1
    Affected ranges
    • ECOSYSTEM: < 2.17-1ubuntu0.1

    Update to 2.17-1ubuntu0.1

Original sources

Check your server →