CVE-2026-42798 describes an integer overflow or wraparound vulnerability (CWE-190) in the ParseCube function within cmscgats.c of the littlecms color engine versions 2.16 through 2.18. This flaw could cause incorrect processing of color profile data, potentially leading to limited information disclosure and denial of service conditions. The vulnerability has a CVSS 3.1 base score of 4.0, reflecting low attack vector (local), high attack complexity, no privileges required, no user interaction, and limited confidentiality and availability impact. No vendor advisory or patch information is currently available.

The vulnerability may allow an attacker with local access and high attack complexity to cause an integer overflow, potentially leading to limited confidentiality loss or availability disruption. There is no indication of integrity impact. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting local access to affected systems and monitor for updates from the littlecms project.