The vulnerability CVE-2026-41254 affects littlecms (lcms2) through version 2.18. It is an integer overflow issue in the CubeSize variable in the cmslut.c source file. The root cause is that the overflow check is done after the multiplication, which can result in an incorrect behavior order (CWE-696). The CVSS 3.1 base score is 4.0, indicating medium severity, with attack vector local, high attack complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and limited availability impact.

The integer overflow may cause incorrect behavior in the color engine, potentially leading to limited confidentiality and availability issues. The vulnerability requires local access and has high attack complexity, reducing the likelihood of exploitation. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently available, users should monitor vendor communications for updates. Until a patch is released, limiting local access to affected systems may reduce risk.