CVE-2026-41254 Integer overflow in little cms color engine
An integer overflow in Little CMS allows attackers to cause denial of service or potentially execute code via crafted color profiles.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41254?
CVE-2026-41254 is a medium-severity vulnerability in littlecms little cms color engine, published on 18 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
Which versions are affected by CVE-2026-41254?
3 open source packages ship an affected version, including java, java-min and jre. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
java Bitnami | All versions | 1.8.0, 8.0.501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2 |
java-min Bitnami | All versions | 1.8.0, 8.0.501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2 |
jre Bitnami | All versions | 1.8.0, 8.0.501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2 |
Linux distribution packages (6)
lcms2 SUSE:Linux Enterprise Micro 5.3 | All versions | 2.12-150400.3.3.1 |
lcms2 SUSE:Linux Enterprise Micro 5.4 | All versions | 2.12-150400.3.3.1 |
lcms2 SUSE:Linux Enterprise Micro 5.5 | All versions | 2.12-150400.3.3.1 |
lcms2 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.15-150600.3.6.1 |
lcms2 SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 2.15-150600.3.6.1 |
lcms2 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.7-9.13.1 |
Products include Littlecms Little Cms.
How do I fix CVE-2026-41254?
Upgrade java to a fixed version for your release line: 1.8.0, 8.0.501, 11.0.32 or 17.0.20.
Is CVE-2026-41254 being exploited?
There is no known exploitation of CVE-2026-41254 in the wild and no public exploit code.
Other vulnerabilities in littlecms little cms color engine
Sources
Also known as ALPINE-CVE-2026-41254, AZL-83075, AZL-83081, BELL-CVE-2026-41254, BIT-java-2026-41254, BIT-java-min-2026-41254 and 41 more.