Every CVE Search/ Get API key

CVE-2026-42798

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

4.0 MediumFix available

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.13%Up 0.1 points since Apr 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.0

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

Record
CVE-2026-42798
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2026-26351 4.0

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

Record
EUVD-2026-26351
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-4m94-357r-hwph 4.0

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

Record
GHSA-4m94-357r-hwph
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
NVD 4.0

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

Record
CVE-2026-42798
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
OSVBELL-CVE-2026-42798 4.0
Record
BELL-CVE-2026-42798
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSV 4.0

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

Record
CVE-2026-42798
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-190
Updated
2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2026-42798 4.0

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

Record
DEBIAN-CVE-2026-42798
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-2325 4.0

lcms2 security update

LittleCMS intends to be an OPEN SOURSE small-footprint color management engine,with special focus on accuracy and performence.It uses the International Color Consortium standard (ICC), which is the modern standard when regarding to color management. The ICC specification is widely used and is referred to in many International and other de-facto standards.

Security Fix(es):

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.(CVE-2026-42798)

Record
OESA-2026-2325
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-2326 4.0

lcms2 security update

LittleCMS intends to be an OPEN SOURSE small-footprint color management engine,with special focus on accuracy and performence.It uses the International Color Consortium standard (ICC), which is the modern standard when regarding to color management. The ICC specification is widely used and is referred to in many International and other de-facto standards.

Security Fix(es):

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.(CVE-2026-42798)

Record
OESA-2026-2326
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-2327 4.0

lcms2 security update

LittleCMS intends to be an OPEN SOURSE small-footprint color management engine,with special focus on accuracy and performence.It uses the International Color Consortium standard (ICC), which is the modern standard when regarding to color management. The ICC specification is widely used and is referred to in many International and other de-facto standards.

Security Fix(es):

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.(CVE-2026-42798)

Record
OESA-2026-2327
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-42798 4.0

Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

Record
UBUNTU-CVE-2026-42798
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2026:21202-1 No score

Security update for lcms2

This update for lcms2 fixes the following issues

  • CVE-2026-41254: integer overflow in CubeSize in cmslut.c (bsc#1264994).
  • CVE-2026-42798: integer overflow in ParseCube in cmscgats.c (bsc#1263703).
Record
openSUSE-SU-2026:21202-1
Updated
2026-11-02
OSVSUSE-SU-2026:22070-1 No score

Security update for lcms2

This update for lcms2 fixes the following issues

  • CVE-2026-41254: integer overflow in CubeSize in cmslut.c (bsc#1264994).
  • CVE-2026-42798: integer overflow in ParseCube in cmscgats.c (bsc#1263703).
Record
SUSE-SU-2026:22070-1
Updated
2026-11-02
OSVSUSE-SU-2026:22506-1 No score

Security update for lcms2

This update for lcms2 fixes the following issues

  • CVE-2026-41254: integer overflow in CubeSize in cmslut.c (bsc#1264994).
  • CVE-2026-42798: integer overflow in ParseCube in cmscgats.c (bsc#1263703).
Record
SUSE-SU-2026:22506-1
Updated
2026-11-02
OSVSUSE-SU-2026:23443-1 No score

Security update for lcms2

This update for lcms2 fixes the following issues:

  • CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).
  • CVE-2026-42798: Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c (bsc#1263703).

Changes for lcms2:

  • Enable threads support (bsc#1247985)
Record
SUSE-SU-2026:23443-1
Updated
2026-11-02
OSVUSN-8250-1 No score

lcms2 vulnerability

It was discovered that Little CMS incorrectly handled certain malformed ICC profiles. An attacker could possibly use this issue to cause Little CMS to crash, resulting in a denial of service.

Record
USN-8250-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lcms2
Alpaquita:25
 2.16-r0 up to 2.19-r0
2.19-r0
lcms2
Alpaquita:stream
 2.16-r0 up to 2.19-r0
2.19-r0
lcms2
Debian:13
 before 2.16-2+deb13u2, plus listed versions
2.16-22.16-2+deb13u1
2.16-2+deb13u2
lcms2
Debian:14
 before 2.19.1-1, plus listed versions
2.16-22.17-12.17-1.1
2.19.1-1
lcms2
openEuler:24.03-LTS
 before 2.16-3.oe2403
2.16-3.oe2403
lcms2
openEuler:24.03-LTS-SP1
 before 2.16-3.oe2403sp1
2.16-3.oe2403sp1
lcms2
openEuler:24.03-LTS-SP3
 before 2.16-3.oe2403sp3
2.16-3.oe2403sp3
lcms2
SUSE:Linux Micro 6.1
From an advisory covering 2 CVEs
 before 2.16-slfo.1.1_2.1
2.16-slfo.1.1_2.1
lcms2
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 2.16-160000.4.1
2.16-160000.4.1
lcms2
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 2.16-160000.4.1
2.16-160000.4.1
Show 4 moreShow less
Affected packages
PackageAffectedFixed
lcms2
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 2.16-2.1
2.16-2.1
lcms2
Ubuntu:25.10
 before 2.16-2ubuntu0.2, plus listed versions
2.16-22.16-2ubuntu0.1
2.16-2ubuntu0.2
lcms2
Ubuntu:26.04:LTS
 before 2.17-1ubuntu0.2, plus listed versions
2.16-22.17-12.17-1ubuntu0.1
2.17-1ubuntu0.2
lcms2
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 2.16-160000.4.1
2.16-160000.4.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42798 is a medium vulnerability (CVSS 4.0) in Littlecms Little Cms Color Engine, published April 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in lcms2 2.19-r0.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open