CVE-2026-85062: CWE-1333: Inefficient Regular Expression Complexity in omgovich colord

The vulnerability arises from the use of an ambiguous numeric regular expression ([+-]?\d*.?\d+) in several synchronous CSS color string matchers within colord versions before 2.9.4. This regex allows overlapping quantifiers to match the same digits in quadratically many ways when rejecting malformed input, leading to excessive processing time. An attacker able to supply an unbounded color string to functions such as colord(), getFormat(), isEqual(), mix(), or contrast() can exploit this to block the processing thread with a large payload. The affected matchers include parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. The issue is resolved in colord version 2.9.4.

An attacker can cause a denial of service by supplying a specially crafted color string that triggers excessive regular expression backtracking, blocking the processing thread. This can degrade application performance or cause unresponsiveness. There is no indication of privilege escalation, data leakage, or code execution. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited impact to availability.

Upgrade to colord version 2.9.4 or later, where the inefficient regular expression complexity issue has been fixed. No other mitigations are indicated or necessary.