CVE-2026-42798
Fixed in a distro release EPSS <1%CVSS 4.0
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.
Products: littlecms little_cms_color_engine
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | lcms2 | 2.19-75.amzn2023.0.1 |
| Amazon Linux 2023 | lcms2-devel | 2.19-75.amzn2023.0.1 |
| Amazon Linux 2023 | lcms2-utils | 2.19-75.amzn2023.0.1 |
| Debian 13 | lcms2 | 2.16-2+deb13u2 |
| Debian 14 | lcms2 | 2.19.1-1 |
| SUSE Linux Enterprise Server 16.0 | lcms2 | 2.16-160000.4.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | lcms2 | 2.16-160000.4.1 |
| SUSE Linux Micro 6.0 | lcms2 | 2.16-2.1 |
| SUSE Linux Micro 6.1 | lcms2 | 2.16-slfo.1.1_2.1 |
| Ubuntu 25.10 | lcms2 | 2.16-2ubuntu0.2 |
| Ubuntu 26.04 LTS | lcms2 | 2.17-1ubuntu0.2 |
| openSUSE Leap 16.0 | lcms2 | 2.16-160000.4.1 |