CVE-2026-42798
CVE-2026-42798
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.
CVSS 4.0 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
little cms color engine
- Versions
- ≥ 2.16, < 2.19: Affected (custom)
Update to 2.19
lcms2 Debian:13
- Versions
- 2.16-2
- 2.16-2+deb13u1
- Affected ranges
- ECOSYSTEM: < 2.16-2+deb13u2
Update to 2.16-2+deb13u2
lcms2 Debian:14
- Versions
- 2.16-2
- 2.17-1
- 2.17-1.1
- Affected ranges
- ECOSYSTEM: < 2.19.1-1
Update to 2.19.1-1
lcms2 Ubuntu:25.10
- Versions
- 2.16-2
- 2.16-2ubuntu0.1
- Affected ranges
- ECOSYSTEM: < 2.16-2ubuntu0.2
Update to 2.16-2ubuntu0.2
lcms2 Ubuntu:26.04:LTS
- Versions
- 2.16-2
- 2.17-1
- 2.17-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: < 2.17-1ubuntu0.2
Update to 2.17-1ubuntu0.2