CVE-2026-41254

Name	CVE-2026-41254
Description	Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4568-1, DLA-4702-1, DLA-4703-1, DSA-6262-1
Debian Bugs	1134335

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
lcms2 (PTS)	bullseye	2.12~rc1-2	vulnerable
	bullseye (security)	2.12~rc1-2+deb11u1	fixed
	bookworm, bookworm (security)	2.14-2+deb12u1	fixed
	trixie (security), trixie	2.16-2+deb13u2	fixed
	forky, sid	2.19.1-1	fixed
openjdk-11 (PTS)	bullseye	11.0.24+8-2~deb11u1	vulnerable
	bullseye (security)	11.0.32+9-2~deb11u1	fixed
	sid	11.0.32+9-2	fixed
openjdk-17 (PTS)	bullseye	17.0.12+7-2~deb11u1	vulnerable
	bullseye (security)	17.0.20+8-1~deb11u1	fixed
	bookworm	17.0.19+10-1~deb12u2	vulnerable
	bookworm (security)	17.0.20+8-1~deb12u1	fixed
	sid	17.0.20+8-1	fixed
openjdk-21 (PTS)	trixie (security), trixie	21.0.11+10-1~deb13u2	vulnerable
	sid	21.0.12+8-1	fixed
openjdk-25 (PTS)	trixie (security), trixie	25.0.3+9-2~deb13u1	vulnerable
	forky, sid	25.0.4+7-1	fixed
openjdk-26 (PTS)	forky	26+35-2	vulnerable
	sid	26.0.2+10-2	fixed
openjdk-8 (PTS)	sid	8u492-ga-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
lcms2	source	bullseye	2.12~rc1-2+deb11u1	DLA-4568-1
lcms2	source	bookworm	2.14-2+deb12u1	DSA-6262-1
lcms2	source	trixie	2.16-2+deb13u2	DSA-6262-1
lcms2	source	(unstable)	2.17-1.1		1134335
openjdk-11	source	bullseye	11.0.32+9-2~deb11u1	DLA-4702-1
openjdk-11	source	(unstable)	11.0.32+9-1
openjdk-17	source	bullseye	17.0.20+8-1~deb11u1	DLA-4703-1
openjdk-17	source	bookworm	17.0.20+8-1~deb12u1	DLA-4703-1
openjdk-17	source	(unstable)	17.0.20+8-1
openjdk-21	source	(unstable)	21.0.12+8-1
openjdk-25	source	(unstable)	25.0.4+7-1
openjdk-26	source	(unstable)	26.0.2+10-1
openjdk-8	source	(unstable)	(unfixed)

Notes

https://openjdk.org/groups/vulnerability/advisories/2026-07-21
https://www.openwall.com/lists/oss-security/2026/04/17/16
https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/
Fixed by: https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0 (master)
Fixed by: https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc (master)