Little CMS (lcms2) up to version 2.18 contains an integer overflow in the CubeSize function in cmslut.c, because the overflow check is performed after the multiplication. This defect can cause an incorrectly calculated size value, leading to memory corruption when the library allocates space for lookup tables. The flaw is categorized as CWE-696, which denotes an incorrect order of operations that can result in unexpected behavior or crashes.

The Little CMS Color Engine, specifically all releases up to and including 2.18, is affected. The vulnerability originates from the lcms2 source code and is therefore present in any software that links to this library without an updated version.

The CVSS score of 4.0 indicates a moderate severity. EPSS information is unavailable, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is not explicitly documented, but integer overflows in library components typically require the attacker to supply crafted input—such as image data processed by the affected functions—in order to trigger the overflow. If successfully exploitable, the overflow could lead to a denial‑of‑service condition or, in vulnerable contexts, arbitrary code execution through secondary memory corruption.