Little CMS (lcms2) up to version 2.18 contains an integer overflow in the CubeSize function in cmslut.c, because the overflow check is performed after the multiplication. This defect can cause an incorrectly computed size value, leading to memory corruption when the library allocates space for lookup tables. The flaw exhibits characteristics of integer overflow (CWE-190) and improper order of operations (CWE-696).

The Little CMS Color Engine, specifically all releases up to and including 2.18, is affected. The vulnerability originates from the lcms2 source code and is therefore present in any software that links to this library without an updated version.

The CVSS score of 4.0 indicates a moderate severity. The EPSS score is less than 1%, indicating a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to supply crafted input that reaches the CubeSize routine, such as malicious image data processed by the library. If successfully exploited, the overflow could lead to a denial‑of‑service condition or, in certain contexts, further memory corruption that might be escalated to arbitrary code execution.