PT-2026-36080 · Unknown · Little Cms

Zerojackyi · CVE-2026-42798 · Published 2026-04-30 · Updated 2026-07-01

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Little CMS (lcms2) versions 2.16 through 2.18

Description An integer overflow exists in the ParseCube() function within the cmscgats.c file. An integer overflow occurs when a program attempts to store a numeric value that is too large for the allocated storage space, potentially leading to unexpected behavior.

Recommendations Update to version 2.19.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-42798

ECHO-F978-7A1E-3DD3

OESA-2026-2325

OESA-2026-2326

OESA-2026-2327

OPENSUSE-SU-2026:21202-1

SUSE-SU-2026:22070-1

SUSE-SU-2026:22506-1

USN-8250-1

Affected Products

Little Cms

References · 32

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42798.json · Exploit
• https://osv.dev/vulnerability/OESA-2026-2327 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22506-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2325 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42798 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-42798 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2326 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8250-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42798 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42798 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8250-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22070-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42798 · Security Note
• https://ubuntu.com/security/CVE-2026-42798 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42798 · Vendor Advisory