GCVE-110-NCSC-2026-261

Advisory PublishedCVSS 7.5/10

Vulnetix · Advisory published July 22, 2026

Little CMS versions up to 2.18 contain integer overflow vulnerabilities in the CubeSize and ParseCube functions, as well as improper handling of malformed ICC profiles, leading to potential information disclosure, denial of service, or arbitrary code execution.

Download JSON Open in Console

Weaknesses (CWE)

CWE-696Incorrect Behavior OrderCWE-295Improper Certificate ValidationCWE-787Out-of-bounds WriteCWE-1333Inefficient Regular Expression ComplexityCWE-190Integer Overflow or WraparoundCWE-476NULL Pointer DereferenceCWE-347Improper Verification of Cryptographic Signature

Risk Scores

CVSS 3.1

7.5/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions	Platforms
Oracle	vers:unknown/*	—	—

Aliases

CVE-2026-41254 CVE-2026-46917 CVE-2026-46968 CVE-2026-47010 CVE-2026-47013 CVE-2026-47021 CVE-2026-47027 CVE-2026-47030 CVE-2026-47034 CVE-2026-47035 CVE-2026-47057 CVE-2026-47058 CVE-2026-47059 CVE-2026-47063 CVE-2026-60147 CVE-2026-60164 CVE-2026-60166 CVE-2026-60526 CVE-2026-62574

References

advisory

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON