Little Cms Color Engine EUVD-2026-23668

Exploitation requires local access to the system and processing of a specially-crafted ICC color profile file by an application linking the vulnerable lcms2 library. The specific condition is when lcms2 constructs a LUT (lookup table) with sufficiently large dimension values that cause integer overflow in the CubeSize multiplication before the overflow check is applied. Non-default configuration is NOT a prerequisite - default behavior of processing any ICC profile makes the system vulnerable if the profile contains malicious dimensions. The vulnerability does NOT require network access, elevated privileges (PR:N), or user interaction beyond the normal operation of color profile processing. Exploitation is limited by: (1) high complexity of crafting a valid exploitable profile, (2) requirement that the target application must parse untrusted ICC profiles, (3) local-only attack vector limiting reach, and (4) need to know or reverse-engineer the memory layout to achieve information disclosure or code execution beyond denial of service.

CVSS 4.0 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) indicates local attack vector with high complexity, no authentication required, no user interaction, and limited impact to confidentiality and availability only. The local-only attack vector significantly constrains real-world risk compared to network-accessible vulnerabilities. EPSS score not provided, preventing quantitative exploitation probability assessment. KEV status unknown - no confirmation of active exploitation by CISA. However, public technical analysis and GitHub commits indicate upstream awareness and remediation. The high complexity requirement (AC:H) suggests successful exploitation requires specific conditions or trigger files, reducing likelihood of accidental exploitation. Integrity impact is none (I:N), limiting damage scope. Real-world risk assessment: moderate priority for applications processing untrusted ICC profiles on multi-user systems or containers, but low urgency for standard desktop/server deployments with controlled color profile inputs. The combination of local-only attack vector and high complexity indicates this is a real vulnerability requiring patching but not an emergency severity issue.

An attacker crafts a malicious ICC color profile file with large cube dimension values (e.g., dimensions > 256) designed to cause integer overflow in the CubeSize calculation. A local user or application on the same system processes this profile (e.g., through image editing software, color management system, or a web application running in a container), triggering the overflow. The resulting buffer overflow corrupts adjacent memory, potentially leaking sensitive data or crashing the application.