Little CMS (lcms2) 2.16 through 2.18 contains an integer overflow in the ParseCube function within cmscgats.c. The overflow can cause a buffer overflow that may corrupt adjacent memory, leading to application crashes or, in a vulnerability scenario, arbitrary memory modification. This weakness falls under CWE‑190 and is not known to allow direct remote code execution but could be leveraged to destabilize systems that process crafted color profile data.

The affected product is the Little CMS color engine from LittleCMS. Versions 2.16, 2.17, and 2.18 are impacted. Version 2.19 or later includes the fix.

With a CVSS score of 4, the vulnerability is considered moderate in severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely require supplying a malicious color profile that triggers the ParseCube routine; unclear if remote or local access is needed. The inability to determine a precise attack vector means organizations should treat the issue as a potential local privilege escalation or crash vector.