libcms2 Integer Overflow Vulnerabilities CVE-2026-41254/41255 with POC

Vulnerability Overview CVE-2026-41254: This is an integer overflow vulnerability affecting the library. The vulnerability allows attackers to trigger an integer overflow by constructing specific inputs, leading to memory corruption. CVE-2026-41255: Another integer overflow vulnerability, also affecting the library. The vulnerability allows attackers to trigger an integer overflow by constructing specific inputs, leading to memory corruption. Affected Scope Affected Versions: version 2.18 and earlier. Affected Platforms: Ubuntu 24.04 LTS, Debian Bookworm, Fedora, Alpine Edge, OpenWrt, etc. Affected Applications: Poppler, Okular, GIMP, CUPS filters, LibreOffice importers, Flask-Bokeh, OpenJDK 21, etc. Remediation Fixed Versions: version 7.5 and later. Fix Status: - Ubuntu 24.04 LTS: Fixed. - Debian Bookworm: Fixed. - Fedora: Fixed. - Alpine Edge: Fixed. - OpenWrt: Fixed. - Bundled in JRE: Fixed. - Other mainstream JRE distributions: Fixed. POC Code Timeline 2026-10: CubeSize() check-after-multiply pattern introduced. 2026-02-19: Fix 1: 64d13b. 2026-03-12: Fix 2: e8641b. 2026-04-13: GHSA-4x66-r2gq-wbqy filed (private advisory). 2026-04-14: MITRE CVE request filed (CVE Request 2025052). 2026-04-16: Submitted with the evidence that existed at the time. 2026-04-16: Asked the maintainer on the GHSA where he'd triage, told him I'd publish otherwise. 2026-04-17: GHSA closed without engagement. Public disclosure. References Vulnerable source (libcms2 2.18): https://github.com/m2m1/little-CMS/blob/libcms2.18/src/cmusl.c#L461 Prior same-codebase CVEs: CVE-2018-16435, CVE-2018-10165. CWE: CWE-190, CWE-125. Write-up + per-consumer evidence: https://github.com/Abhinavagarwal97.github.io/posts/libcms2-cubesize-overflow/

Goal Reached Thanks to every supporter — we hit 100%!

libcms2 Integer Overflow Vulnerabilities CVE-2026-41254/41255 with POC

More from this source