The vulnerability CVE-2026-41254 affects littlecms (lcms2) through version 2.18. It is an integer overflow issue in the CubeSize variable in the cmslut.c source file. The root cause is that the overflow check is done after the multiplication, which can result in an incorrect behavior order (CWE-696). The CVSS 3.1 base score is 4.0 (medium), with attack vector local, high attack complexity, no privileges required, no user interaction, unchanged scope, and impacts limited confidentiality and availability.

Exploitation of this integer overflow could lead to limited confidentiality loss and availability disruption in applications using the affected littlecms color engine versions. The vulnerability does not affect integrity and requires local access with high attack complexity, reducing the likelihood of exploitation. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. Until a patch is available, avoid processing untrusted input with affected versions of littlecms to reduce risk.