Bug 2459420 (CVE-2026-41254)

Summary: CVE-2026-41254 Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhinavagarwal1996, ahughes, fferrari, khosford, mtorre, pjindal, rhel-process-autobot, tfitzsim, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Little CMS. An integer overflow in the `CubeSize` function within `cmslut.c` occurs because the overflow check is performed after the multiplication. An attacker could exploit this vulnerability by providing a specially crafted input, potentially leading to information disclosure or a denial of service (DoS), which makes the system unavailable to legitimate users.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2459627, 2459628, 2459629, 2459630, 2459631, 2459632, 2459633, 2459634, 2459635, 2459636, 2459637    
Bug Blocks:    

Description OSIDB Bzimport 2026-04-18 07:01:29 UTC
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

Comment 3 abhinav agarwal 2026-04-23 04:40:12 UTC
This has been rescored by nvd to 7.5 (high) Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

https://nvd.nist.gov/vuln/detail/CVE-2026-41254

Writeup with exploit: https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/

Comment 4 errata-xmlrpc 2026-07-22 23:47:31 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9
  Red Hat Enterprise Linux 10

Via RHSA-2026:42899 https://access.redhat.com/errata/RHSA-2026:42899

Comment 5 errata-xmlrpc 2026-07-23 00:40:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8
  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 9.6 Extended Update Support
  Red Hat Enterprise Linux 9

Via RHSA-2026:42887 https://access.redhat.com/errata/RHSA-2026:42887

Comment 6 errata-xmlrpc 2026-07-23 02:16:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support
  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 9.6 Extended Update Support
  Red Hat Enterprise Linux 8
  Red Hat Enterprise Linux 10
  Red Hat Enterprise Linux 9

Via RHSA-2026:42895 https://access.redhat.com/errata/RHSA-2026:42895

Comment 7 errata-xmlrpc 2026-07-23 07:55:42 UTC
This issue has been addressed in the following products:

  Red Hat OpenJDK 11 els for RHEL 7
  Red Hat OpenJDK 11 els for RHEL 8
  Red Hat OpenJDK 11 els for RHEL 9

Via RHSA-2026:42880 https://access.redhat.com/errata/RHSA-2026:42880

Comment 8 errata-xmlrpc 2026-07-23 08:31:13 UTC
This issue has been addressed in the following products:

  OPENJDK ELS 11.0.32

Via RHSA-2026:42881 https://access.redhat.com/errata/RHSA-2026:42881

Comment 9 errata-xmlrpc 2026-07-23 08:31:17 UTC
This issue has been addressed in the following products:

  OPENJDK ELS 11.0.32

Via RHSA-2026:42882 https://access.redhat.com/errata/RHSA-2026:42882

Comment 10 errata-xmlrpc 2026-07-23 11:32:45 UTC
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 8u502

Via RHSA-2026:42879 https://access.redhat.com/errata/RHSA-2026:42879

Comment 11 errata-xmlrpc 2026-07-23 11:33:14 UTC
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 8u502

Via RHSA-2026:42878 https://access.redhat.com/errata/RHSA-2026:42878

Comment 12 errata-xmlrpc 2026-07-23 11:34:08 UTC
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 17.0.20

Via RHSA-2026:42889 https://access.redhat.com/errata/RHSA-2026:42889

Comment 13 errata-xmlrpc 2026-07-23 11:34:20 UTC
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 17.0.20

Via RHSA-2026:42893 https://access.redhat.com/errata/RHSA-2026:42893

Comment 14 errata-xmlrpc 2026-07-23 11:37:48 UTC
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 21.0.12

Via RHSA-2026:42898 https://access.redhat.com/errata/RHSA-2026:42898

Comment 15 errata-xmlrpc 2026-07-23 11:37:57 UTC
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 21.0.12

Via RHSA-2026:42897 https://access.redhat.com/errata/RHSA-2026:42897

Comment 16 errata-xmlrpc 2026-07-23 11:44:12 UTC
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 25.0.4

Via RHSA-2026:42900 https://access.redhat.com/errata/RHSA-2026:42900

Comment 17 errata-xmlrpc 2026-07-23 12:04:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:42876 https://access.redhat.com/errata/RHSA-2026:42876

Comment 18 errata-xmlrpc 2026-07-23 15:35:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 9.6 Extended Update Support
  Red Hat Enterprise Linux 9
  Red Hat Enterprise Linux 8
  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:42877 https://access.redhat.com/errata/RHSA-2026:42877

Comment 19 errata-xmlrpc 2026-07-30 17:38:38 UTC
This issue has been addressed in the following products:

  Temurin Build of OpenJDK 25.0.4

Via RHSA-2026:48845 https://access.redhat.com/errata/RHSA-2026:48845

Comment 27 errata-xmlrpc 2026-08-10 16:47:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:52949 https://access.redhat.com/errata/RHSA-2026:52949

Comment 28 errata-xmlrpc 2026-08-10 16:49:14 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support
  Red Hat Enterprise Linux 10

Via RHSA-2026:52948 https://access.redhat.com/errata/RHSA-2026:52948