Loading story…
A publicly disclosed flaw in Little CMS 2 (lcms2) affects all released versions through 2.18, where an integer overflow in CubeSize() can produce an undersized CLUT allocation and lead to out-of-bounds reads. The bug was reported as a check-after-multiply error and mapped to CWE-190 and CWE-125, with researchers showing that malformed PDFs or ICC profiles could crash applications that rely on liblcms2 for color processing.
The issue was reproduced against stock Ubuntu 24.04 components and other common builds, impacting Poppler tools, evince-thumbnailer, tumblerd, Okular, cups-filters pdftoraster, GIMP, lcms2 utilities, and OpenJDK 21, with additional confirmation on Temurin 21.0.9 for Windows and Homebrew little-cms2 2.18. Researchers also described a limited information disclosure primitive on Linux when ASLR is disabled. Although upstream reportedly fixed the flaw on the master branch in February and March 2026, no new release, advisory, or CVE had been issued at the time of disclosure, despite a GHSA filing and a MITRE CVE request.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
By the time of the public discussion, a GitHub Security Advisory filing and a MITRE CVE request had been submitted for the lcms2 CubeSize() flaw. However, no CVE had yet been assigned.
On oss-sec, a researcher publicly disclosed that all released lcms2 versions through 2.18 were affected by a CubeSize() integer overflow causing crashes in multiple consumers, including Poppler tools, evince-thumbnailer, Okular, cups-filters, GIMP, and OpenJDK. The disclosure also noted limited information disclosure potential on Linux and stated that no CVE or upstream release was available at the time.
Upstream Little CMS fixed the CubeSize() check-after-multiply integer overflow on the master branch in February and March 2026, addressing an undersized CLUT allocation that could lead to out-of-bounds reads. At that time, no new release or advisory had yet been issued.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceseclists.org
Open sourceseclists.org
Open sourcegithub.com
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in widely used file-parsing libraries, allowing crafted media files to trigger memory-safety failures during parsing. In **cgltf** `<= 1.15`, `CVE-2026-32845` stems from an integer overflow in `cgltf_validate()` while checking sparse accessors in malicious glTF or GLB files. The unchecked arithmetic can lead to heap buffer over-reads in `cgltf_calc_index_bound()`, causing crashes and potentially exposing process memory. A separate flaw, `CVE-2026-40494`, affects the **SAIL** image loading and saving library’s TGA RLE decoder in `tga.c`. The bug is a heap-based buffer overflow caused by missing bounds checks on the raw-packet path, while the run-packet path correctly clamps writes; attackers can use a crafted TGA file to write up to 496 bytes of controlled data past the end of a heap buffer. The issue affects versions before commit `45d48d1f2e8e0d73e80bc1fd5310cb57f4547302` and carries a critical `CVSS:3.1` rating due to potential confidentiality, integrity, and availability impact.
Jun 29, 2026
CERT Polska disclosed an **integer overflow** vulnerability in **GNU diffutils**, tracked as `CVE-2026-53910`. The issue affects the widely used file-comparison utility suite and was published as a security notice identifying the flaw in the software. A follow-on report amplified the disclosure and confirmed that the core issue is the integer overflow in GNU diffutils, pointing back to the CERT Polska advisory as the primary source. Organizations using GNU diffutils should review the vendor and CERT guidance, identify affected deployments, and prioritize patching or other mitigations once updates are available.
Jul 22, 2026
Multiple **critical vulnerabilities** were disclosed in **GStreamer**, affecting several media parsers and demuxers including **ASF, RealMedia, DVB Subtitles, JPEG, RIFF, H.265, and H.266**. The issues include **heap/stack buffer overflows, out-of-bounds writes, and integer overflows/underflows** that can lead to **denial of service** or **remote code execution** when a user opens a crafted media file, with the most severe flaws identified as **CVE-2026-3083** and **CVE-2026-3085** in the `rtpqdm2depay` component. Belgian CCB warned that exploitation could expose sensitive data, compromise systems, and disrupt operations, and urged organizations to patch immediately. Debian separately issued **DSA-6167-1** for `gst-plugins-base1.0`, addressing **CVE-2026-2921**, an **integer overflow** in the **RIFF parser** that may cause a crash or potentially allow arbitrary code execution via a malformed media file. Debian released fixes for **bookworm** in version `1.22.0-3+deb12u6` and for **trixie** in version `1.26.2-1+deb13u1`. The GIMP advisory is unrelated to this event because it covers a separate **HDR file parsing** heap-based buffer overflow, **CVE-2026-2049**, in a different product.
Jun 29, 2026