PT-2026-33596 · Unknown+2 · Little Cms+2

Published 2026-04-18 · Updated 2026-06-01 · CVE-2026-41254

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Little CMS (lcms2) versions prior to 2.19

Description An integer overflow occurs in the CubeSize calculation within the cmslut.c file because the overflow check is executed after the multiplication operation.

Recommendations Update to a version newer than 2.18.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-696

CWE-190

Related Identifiers

CVE-2026-41254

ECHO-9584-7CF3-54EC

OESA-2026-2128

USN-8209-1

USN-8209-2

Affected Products

Linuxmint

Little Cms

Ubuntu

References · 28

• 🔥 https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow · Exploit
• https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0 · Patch
• https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-41254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41254 · Security Note
• https://osv.dev/vulnerability/USN-8209-2 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-41254 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8209-2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41254 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-41254 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-41254 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2128 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41254 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8209-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41254 · Vendor Advisory