Medium severity4.0NVD Advisory· Published Apr 18, 2026· Updated Jun 17, 2026
CVE-2026-41254
CVE-2026-41254
Description
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
108- Range: <=2.18
- osv-coords106 versionspkg:rpm/almalinux/java-1.8.0-openjdkpkg:rpm/almalinux/java-1.8.0-openjdk-accessibilitypkg:rpm/almalinux/java-1.8.0-openjdk-accessibility-fastdebugpkg:rpm/almalinux/java-1.8.0-openjdk-accessibility-slowdebugpkg:rpm/almalinux/java-1.8.0-openjdk-demopkg:rpm/almalinux/java-1.8.0-openjdk-demo-fastdebugpkg:rpm/almalinux/java-1.8.0-openjdk-demo-slowdebugpkg:rpm/almalinux/java-1.8.0-openjdk-develpkg:rpm/almalinux/java-1.8.0-openjdk-devel-fastdebugpkg:rpm/almalinux/java-1.8.0-openjdk-devel-slowdebugpkg:rpm/almalinux/java-1.8.0-openjdk-fastdebugpkg:rpm/almalinux/java-1.8.0-openjdk-headlesspkg:rpm/almalinux/java-1.8.0-openjdk-headless-fastdebugpkg:rpm/almalinux/java-1.8.0-openjdk-headless-slowdebugpkg:rpm/almalinux/java-1.8.0-openjdk-javadocpkg:rpm/almalinux/java-1.8.0-openjdk-javadoc-zippkg:rpm/almalinux/java-1.8.0-openjdk-slowdebugpkg:rpm/almalinux/java-1.8.0-openjdk-srcpkg:rpm/almalinux/java-1.8.0-openjdk-src-fastdebugpkg:rpm/almalinux/java-1.8.0-openjdk-src-slowdebugpkg:rpm/almalinux/java-17-openjdkpkg:rpm/almalinux/java-17-openjdk-demopkg:rpm/almalinux/java-17-openjdk-demo-fastdebugpkg:rpm/almalinux/java-17-openjdk-demo-slowdebugpkg:rpm/almalinux/java-17-openjdk-develpkg:rpm/almalinux/java-17-openjdk-devel-fastdebugpkg:rpm/almalinux/java-17-openjdk-devel-slowdebugpkg:rpm/almalinux/java-17-openjdk-fastdebugpkg:rpm/almalinux/java-17-openjdk-headlesspkg:rpm/almalinux/java-17-openjdk-headless-fastdebugpkg:rpm/almalinux/java-17-openjdk-headless-slowdebugpkg:rpm/almalinux/java-17-openjdk-javadocpkg:rpm/almalinux/java-17-openjdk-javadoc-zippkg:rpm/almalinux/java-17-openjdk-jmodspkg:rpm/almalinux/java-17-openjdk-jmods-fastdebugpkg:rpm/almalinux/java-17-openjdk-jmods-slowdebugpkg:rpm/almalinux/java-17-openjdk-slowdebugpkg:rpm/almalinux/java-17-openjdk-srcpkg:rpm/almalinux/java-17-openjdk-src-fastdebugpkg:rpm/almalinux/java-17-openjdk-src-slowdebugpkg:rpm/almalinux/java-17-openjdk-static-libspkg:rpm/almalinux/java-17-openjdk-static-libs-fastdebugpkg:rpm/almalinux/java-17-openjdk-static-libs-slowdebugpkg:rpm/almalinux/java-21-openjdkpkg:rpm/almalinux/java-21-openjdk-demopkg:rpm/almalinux/java-21-openjdk-demo-fastdebugpkg:rpm/almalinux/java-21-openjdk-demo-slowdebugpkg:rpm/almalinux/java-21-openjdk-develpkg:rpm/almalinux/java-21-openjdk-devel-fastdebugpkg:rpm/almalinux/java-21-openjdk-devel-slowdebugpkg:rpm/almalinux/java-21-openjdk-fastdebugpkg:rpm/almalinux/java-21-openjdk-headlesspkg:rpm/almalinux/java-21-openjdk-headless-fastdebugpkg:rpm/almalinux/java-21-openjdk-headless-slowdebugpkg:rpm/almalinux/java-21-openjdk-javadocpkg:rpm/almalinux/java-21-openjdk-javadoc-zippkg:rpm/almalinux/java-21-openjdk-jmodspkg:rpm/almalinux/java-21-openjdk-jmods-fastdebugpkg:rpm/almalinux/java-21-openjdk-jmods-slowdebugpkg:rpm/almalinux/java-21-openjdk-slowdebugpkg:rpm/almalinux/java-21-openjdk-srcpkg:rpm/almalinux/java-21-openjdk-src-fastdebugpkg:rpm/almalinux/java-21-openjdk-src-slowdebugpkg:rpm/almalinux/java-21-openjdk-static-libspkg:rpm/almalinux/java-21-openjdk-static-libs-fastdebugpkg:rpm/almalinux/java-21-openjdk-static-libs-slowdebugpkg:rpm/almalinux/java-25-openjdkpkg:rpm/almalinux/java-25-openjdk-crypto-adapterpkg:rpm/almalinux/java-25-openjdk-crypto-adapter-fastdebugpkg:rpm/almalinux/java-25-openjdk-crypto-adapter-slowdebugpkg:rpm/almalinux/java-25-openjdk-demopkg:rpm/almalinux/java-25-openjdk-demo-fastdebugpkg:rpm/almalinux/java-25-openjdk-demo-slowdebugpkg:rpm/almalinux/java-25-openjdk-develpkg:rpm/almalinux/java-25-openjdk-devel-fastdebugpkg:rpm/almalinux/java-25-openjdk-devel-slowdebugpkg:rpm/almalinux/java-25-openjdk-fastdebugpkg:rpm/almalinux/java-25-openjdk-headlesspkg:rpm/almalinux/java-25-openjdk-headless-fastdebugpkg:rpm/almalinux/java-25-openjdk-headless-slowdebugpkg:rpm/almalinux/java-25-openjdk-javadocpkg:rpm/almalinux/java-25-openjdk-javadoc-zippkg:rpm/almalinux/java-25-openjdk-jmodspkg:rpm/almalinux/java-25-openjdk-jmods-fastdebugpkg:rpm/almalinux/java-25-openjdk-jmods-slowdebugpkg:rpm/almalinux/java-25-openjdk-slowdebugpkg:rpm/almalinux/java-25-openjdk-srcpkg:rpm/almalinux/java-25-openjdk-src-fastdebugpkg:rpm/almalinux/java-25-openjdk-src-slowdebugpkg:rpm/almalinux/java-25-openjdk-static-libspkg:rpm/almalinux/java-25-openjdk-static-libs-fastdebugpkg:rpm/almalinux/java-25-openjdk-static-libs-slowdebugpkg:rpm/opensuse/java-11-openj9&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/java-11-openjdk&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/java-17-openj9&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/java-17-openjdk&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/java-17-openjdk&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/java-1_8_0-openjdk&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/java-21-openj9&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/java-21-openjdk&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/java-21-openjdk&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/java-25-openj9&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/java-25-openjdk&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/java-25-openjdk&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/lcms2&distro=openSUSE%20Leap%2016.0pkg:rpm/suse/lcms2&distro=SUSE%20Linux%20Micro%206.1
< 1:1.8.0.502.b07-1.1.el8+ 105 more
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:1.8.0.502.b07-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:17.0.20.0.8-1.1.el8
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:21.0.12.0.8-1.2.el10_2.alma.2
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 1:25.0.4.0.7-1.1.el10_2.alma.1
- (no CPE)range: < 11.0.32.0-1.1
- (no CPE)range: < 11.0.32.0-1.1
- (no CPE)range: < 17.0.20.0-1.1
- (no CPE)range: < 17.0.20.0-160000.1.1
- (no CPE)range: < 17.0.20.0-1.1
- (no CPE)range: < 1.8.0.502-1.1
- (no CPE)range: < 21.0.12.0-1.1
- (no CPE)range: < 21.0.12.0-160000.1.1
- (no CPE)range: < 21.0.12.0-1.1
- (no CPE)range: < 25.0.4.0-1.1
- (no CPE)range: < 25.0.4.0-160000.1.1
- (no CPE)range: < 25.0.4.0-1.1
- (no CPE)range: < 2.16-160000.4.1
- (no CPE)range: < 2.16-slfo.1.1_2.1
Patches
Vulnerability mechanics
References
6- github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0nvdPatch
- github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bcnvdPatch
- abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/nvdExploitThird Party Advisory
- www.openwall.com/lists/oss-security/2026/04/17/16nvdMailing ListThird Party Advisory
- github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qqnvdBroken Link
- lists.debian.org/debian-lts-announce/2026/05/msg00014.htmlnvd
News mentions
0No linked articles in our index yet.