Little CMS (lcms2) CVE-2026-42798

The vulnerability requires that an application call the ParseCube function when processing CGATS format color lookup tables or ICC profiles containing cube LUTs with lut_size parameters. Exploitation depends on: (1) the application parsing untrusted ICC color profiles or CGATS files from external sources (not a default behavior for many applications unless explicitly imported), (2) a crafted LUT size value (typically > 65) supplied in the file that causes integer overflow during the lut_size × lut_size × lut_size calculation, (3) the application being linked against lcms2 2.16-2.18. Non-default configurations that increase risk include automatic profile loading from documents, accepting user-supplied profile files, or processing color data from untrusted sources. Default secure configurations (trusted profile sources, sandboxed parsing) substantially limit exploitability.

CVSS 4.0 with local attack vector (AV:L), high complexity (AC:H), and no privileges required reflects a bounded-risk scenario. The local attack vector means an attacker must already have file system access or ability to feed malicious ICC profile or CGATS files to the application. AC:H (high complexity) suggests exploitation requires specific conditions or careful crafting. CVSS impact shows low confidentiality (C:L) and low availability (A:L) - information disclosure or denial of service rather than remote code execution. This profile suggests exploitation is difficult and impact is limited, making real-world risk lower than the CVSS score initially suggests. The EPSS and KEV status are not provided, so widespread exploitation cannot be confirmed. Given that this affects color profile processing (a specialized workflow in image applications, document readers, and design tools), exploitation likely requires targeted delivery of malicious .icc or .cgats files to vulnerable software. Organizations running systems that do not import ICC profiles from untrusted sources face minimal risk.

An attacker crafts a malicious ICC color profile or CGATS LUT file with a LUT size value that triggers integer overflow when multiplied in ParseCube (e.g., lut_size = 2^20 on 32-bit systems). A user opens a malicious TIFF, PDF, or PNG image containing the embedded profile in an application linked to vulnerable lcms2 (GIMP, LibreOffice, or Ghostscript). The integer overflow corrupts heap memory or causes a denial of service, or the overflow enables information disclosure from adjacent heap allocations. Exploitation requires the victim to open a file from an untrusted source, making social engineering or drive-by download necessary.