CVE-2026-41254

A flaw was found in Little CMS. An integer overflow in the CubeSize function within cmslut.c occurs because the overflow check is performed after the multiplication. An attacker could exploit this vulnerability by providing a specially crafted input, potentially leading to information disclosure or a denial of service (DoS), which makes the system unavailable to legitimate users.

This Moderate flaw in Little CMS (lcms2) involves an integer overflow within the CubeSize function, occurring due to an insufficient check during multiplication. Processing specially crafted color profiles or image data could lead to information disclosure or a denial of service, affecting the availability of applications that rely on lcms2 for color management. Exploitation requires user interaction with malicious content.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.