{
  "threat_severity" : "Moderate",
  "public_date" : "2026-04-18T06:43:13Z",
  "bugzilla" : {
    "description" : "Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize",
    "id" : "2459420",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2459420"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-190",
  "details" : [ "Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.", "A flaw was found in Little CMS. An integer overflow in the `CubeSize` function within `cmslut.c` occurs because the overflow check is performed after the multiplication. An attacker could exploit this vulnerability by providing a specially crafted input, potentially leading to information disclosure or a denial of service (DoS), which makes the system unavailable to legitimate users." ],
  "statement" : "This Moderate flaw in Little CMS (lcms2) involves an integer overflow within the `CubeSize` function, occurring due to an insufficient check during multiplication. Processing specially crafted color profiles or image data could lead to information disclosure or a denial of service, affecting the availability of applications that rely on lcms2 for color management. Exploitation requires user interaction with malicious content.",
  "affected_release" : [ {
    "product_name" : "OPENJDK ELS 11.0.32",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42881",
    "cpe" : "cpe:/a:redhat:openjdk_els:11",
    "package" : "java-11-openjdk-portable"
  }, {
    "product_name" : "OPENJDK ELS 11.0.32",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42882",
    "cpe" : "cpe:/a:redhat:openjdk_els:11"
  }, {
    "product_name" : "Red Hat Build of OpenJDK 17.0.20",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42889",
    "cpe" : "cpe:/a:redhat:openjdk:17",
    "package" : "java-17-openjdk-portable"
  }, {
    "product_name" : "Red Hat Build of OpenJDK 17.0.20",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42893",
    "cpe" : "cpe:/a:redhat:openjdk:17"
  }, {
    "product_name" : "Red Hat Build of OpenJDK 21.0.12",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42897",
    "cpe" : "cpe:/a:redhat:openjdk:21",
    "package" : "java-21-openjdk-portable"
  }, {
    "product_name" : "Red Hat Build of OpenJDK 21.0.12",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42898",
    "cpe" : "cpe:/a:redhat:openjdk:21"
  }, {
    "product_name" : "Red Hat Build of OpenJDK 25.0.4",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42900",
    "cpe" : "cpe:/a:redhat:openjdk:25",
    "package" : "java-25-openjdk-portable"
  }, {
    "product_name" : "Red Hat Build of OpenJDK 8u502",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42878",
    "cpe" : "cpe:/a:redhat:openjdk:1.8",
    "package" : "java-1.8.0-openjdk-portable"
  }, {
    "product_name" : "Red Hat Build of OpenJDK 8u502",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42879",
    "cpe" : "cpe:/a:redhat:openjdk:1.8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42895",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "java-21-openjdk-1:21.0.12.0.8-1.2.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42899",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "java-25-openjdk-1:25.0.4.0.7-1.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-10T00:00:00Z",
    "advisory" : "RHSA-2026:52948",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "java-21-ibm-semeru-certified-jdk-1:21.0.12.0.8-2.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42895",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "java-21-openjdk-1:21.0.12.0.8-1.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-08-10T00:00:00Z",
    "advisory" : "RHSA-2026:52948",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "java-21-ibm-semeru-certified-jdk-1:21.0.12.0.8-1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42876",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el7_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42877",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42887",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "java-17-openjdk-1:17.0.20.0.8-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42895",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "java-21-openjdk-1:21.0.12.0.8-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-10T00:00:00Z",
    "advisory" : "RHSA-2026:52949",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::supplementary",
    "package" : "java-1.8.0-ibm-1:1.8.0.8.70-1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42877",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42887",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "java-17-openjdk-1:17.0.20.0.8-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42877",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42887",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.4",
    "package" : "java-17-openjdk-1:17.0.20.0.8-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42877",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42887",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "java-17-openjdk-1:17.0.20.0.8-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42877",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.6",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42887",
    "cpe" : "cpe:/a:redhat:rhel_eus_long_life:8.6",
    "package" : "java-17-openjdk-1:17.0.20.0.8-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42877",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42887",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "java-17-openjdk-1:17.0.20.0.8-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42877",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42887",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "java-17-openjdk-1:17.0.20.0.8-1.1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42877",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.2.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42887",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "java-17-openjdk-1:17.0.20.0.8-1.2.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42895",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "java-21-openjdk-1:21.0.12.0.8-1.2.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42899",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "java-25-openjdk-1:25.0.4.0.7-1.1.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42877",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42887",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "java-17-openjdk-1:17.0.20.0.8-1.1.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42877",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.4",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42887",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.4",
    "package" : "java-17-openjdk-1:17.0.20.0.8-1.1.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42895",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.4",
    "package" : "java-21-openjdk-1:21.0.12.0.8-1.1.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42877",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42887",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "java-17-openjdk-1:17.0.20.0.8-1.1.el9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42895",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "java-21-openjdk-1:21.0.12.0.8-1.1.el9"
  }, {
    "product_name" : "Red Hat OpenJDK 11 els for RHEL 7",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42880",
    "cpe" : "cpe:/a:redhat:openjdk_els:11::el7",
    "package" : "java-11-openjdk-1:11.0.32.0.9-1.el7_9"
  }, {
    "product_name" : "Red Hat OpenJDK 11 els for RHEL 8",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42880",
    "cpe" : "cpe:/a:redhat:openjdk_els:11::el8",
    "package" : "java-11-openjdk-1:11.0.32.0.9-1.el8"
  }, {
    "product_name" : "Red Hat OpenJDK 11 els for RHEL 9",
    "release_date" : "2026-07-23T00:00:00Z",
    "advisory" : "RHSA-2026:42880",
    "cpe" : "cpe:/a:redhat:openjdk_els:11::el9",
    "package" : "java-11-openjdk-1:11.0.32.0.9-1.el9"
  }, {
    "product_name" : "Temurin Build of OpenJDK 25.0.4",
    "release_date" : "2026-07-30T00:00:00Z",
    "advisory" : "RHSA-2026:48845",
    "cpe" : "cpe:/a:redhat:openjdk:25"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat build of OpenJDK 11 ELS",
    "fix_state" : "Fix deferred",
    "package_name" : "java-17-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk_els:11"
  }, {
    "product_name" : "Red Hat build of OpenJDK 11 ELS",
    "fix_state" : "Fix deferred",
    "package_name" : "java-21-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk_els:11"
  }, {
    "product_name" : "Red Hat build of OpenJDK 11 ELS",
    "fix_state" : "Fix deferred",
    "package_name" : "java-21-openjdk-vanilla",
    "cpe" : "cpe:/a:redhat:openjdk_els:11"
  }, {
    "product_name" : "Red Hat build of OpenJDK 11 ELS",
    "fix_state" : "Fix deferred",
    "package_name" : "java-25-openjdk-portable",
    "cpe" : "cpe:/a:redhat:openjdk_els:11"
  }, {
    "product_name" : "Red Hat build of OpenJDK 17",
    "fix_state" : "Fix deferred",
    "package_name" : "java-17-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:17"
  }, {
    "product_name" : "Red Hat build of OpenJDK 17",
    "fix_state" : "Fix deferred",
    "package_name" : "java-21-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:17"
  }, {
    "product_name" : "Red Hat build of OpenJDK 17",
    "fix_state" : "Fix deferred",
    "package_name" : "java-21-openjdk-vanilla",
    "cpe" : "cpe:/a:redhat:openjdk:17"
  }, {
    "product_name" : "Red Hat build of OpenJDK 17",
    "fix_state" : "Fix deferred",
    "package_name" : "java-25-openjdk-portable",
    "cpe" : "cpe:/a:redhat:openjdk:17"
  }, {
    "product_name" : "Red Hat build of OpenJDK 1.8",
    "fix_state" : "Fix deferred",
    "package_name" : "java-17-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:1.8"
  }, {
    "product_name" : "Red Hat build of OpenJDK 1.8",
    "fix_state" : "Fix deferred",
    "package_name" : "java-21-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:1.8"
  }, {
    "product_name" : "Red Hat build of OpenJDK 1.8",
    "fix_state" : "Fix deferred",
    "package_name" : "java-21-openjdk-vanilla",
    "cpe" : "cpe:/a:redhat:openjdk:1.8"
  }, {
    "product_name" : "Red Hat build of OpenJDK 21",
    "fix_state" : "Fix deferred",
    "package_name" : "java-17-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:21"
  }, {
    "product_name" : "Red Hat build of OpenJDK 21",
    "fix_state" : "Fix deferred",
    "package_name" : "java-21-openjdk",
    "cpe" : "cpe:/a:redhat:openjdk:21"
  }, {
    "product_name" : "Red Hat build of OpenJDK 21",
    "fix_state" : "Fix deferred",
    "package_name" : "java-21-openjdk-vanilla",
    "cpe" : "cpe:/a:redhat:openjdk:21"
  }, {
    "product_name" : "Red Hat build of OpenJDK 21",
    "fix_state" : "Fix deferred",
    "package_name" : "java-25-openjdk-portable",
    "cpe" : "cpe:/a:redhat:openjdk:21"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "glycin-loaders",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "lcms2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "lcms2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "lcms2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "lcms2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-41254\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41254\nhttps://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/\nhttps://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0\nhttps://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc\nhttps://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq\nhttps://www.openwall.com/lists/oss-security/2026/04/17/16" ],
  "name" : "CVE-2026-41254",
  "csaw" : false
}