DEBIAN-CVE-2026-41254

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-41254
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41254.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-41254
Upstream
Published
2026-04-18T07:16:10Z
Modified
2026-09-05T17:00:10Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

References

Affected packages

Debian:12
lcms2

Package

Name
lcms2
Purl
pkg:deb/debian/lcms2?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.14-2+deb12u1

Affected versions

2.*
2.14-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41254.json"
openjdk-17

Package

Name
openjdk-17
Purl
pkg:deb/debian/openjdk-17?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.0.20+8-1~deb12u1

Affected versions

17.*
17.0.6+10-1
17.0.7+7-1~deb11u1
17.0.7+7-1~deb12u1
17.0.7+7-1
17.0.7+7-2
17.0.8~6-1
17.0.8~6-2
17.0.8~6-3
17.0.8~6-4
17.0.8~6-5
17.0.8+7-1~deb12u1
17.0.8+7-1
17.0.9~4ea-1
17.0.9~6ea-1
17.0.9+9-1~deb11u1
17.0.9+9-1~deb12u1
17.0.9+9-1
17.0.9+9-2
17.0.10~6ea-1
17.0.10+7-1~deb11u1
17.0.10+7-1~deb12u1
17.0.10+7-1
17.0.10+7-2
17.0.10+7-3
17.0.11~6ea-1
17.0.11~7ea-1
17.0.11+9-1~deb11u1
17.0.11+9-1~deb12u1
17.0.11+9-1
17.0.12~6ea-1
17.0.12+7-1
17.0.12+7-2~deb11u1
17.0.12+7-2~deb12u1
17.0.12+7-2
17.0.13~6ea-1
17.0.13+11-1~deb11u1
17.0.13+11-1~deb12u1
17.0.13+11-1
17.0.13+11-2~deb12u1
17.0.13+11-2
17.0.14~6ea-1
17.0.14+7-1~deb11u1
17.0.14+7-1~deb12u1
17.0.14+7-1
17.0.15~4ea-1
17.0.15~5ea-1
17.0.15+6-1~deb11u1
17.0.15+6-1~deb12u1
17.0.15+6-1
17.0.16~5ea-1
17.0.16+8-1~deb11u1
17.0.16+8-1~deb12u1
17.0.16+8-1
17.0.17~5ea-1
17.0.17~8ea-1
17.0.17+10-1~deb11u1
17.0.17+10-1~deb12u1
17.0.17+10-1
17.0.18~7ea-1
17.0.18+8-1~deb11u1
17.0.18+8-1~deb12u1
17.0.18+8-1
17.0.19~6ea-1
17.0.19~9ea-1
17.0.19~9ea-2
17.0.19+10-1~deb11u1
17.0.19+10-1~deb12u1
17.0.19+10-1~deb12u2
17.0.19+10-1
17.0.20~5ea-1
17.0.20~7ea-1
17.0.20+8-1~deb11u1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41254.json"
Debian:13
lcms2

Package

Name
lcms2
Purl
pkg:deb/debian/lcms2?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.16-2+deb13u2

Affected versions

2.*
2.16-2
2.16-2+deb13u1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41254.json"
openjdk-21

Package

Name
openjdk-21
Purl
pkg:deb/debian/openjdk-21?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
21.0.12+8-1~deb13u1

Affected versions

21.*
21.0.8+9-1
21.0.9~5ea-1
21.0.9~8ea-1
21.0.9+10-1~deb13u1
21.0.9+10-1
21.0.10~4ea-1
21.0.10~6ea-1
21.0.10+7-1~deb13u1
21.0.10+7-1
21.0.11~5ea-1
21.0.11~6ea-1
21.0.11~8ea-1
21.0.11~9ea-1
21.0.11~9ea-2
21.0.11+10-1~deb13u1
21.0.11+10-1~deb13u2
21.0.11+10-1
21.0.12~5ea-1
21.0.12~7ea-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41254.json"
openjdk-25

Package

Name
openjdk-25
Purl
pkg:deb/debian/openjdk-25?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
25.0.4+7-1~deb13u1

Affected versions

Other
25~32ea-1
25~34ea-1
25~36ea-1
25+36-1
25.*
25.0.1+8-1~deb13u1
25.0.1+8-1
25.0.1+8-2
25.0.1+8-3
25.0.2+10-1~deb13u2
25.0.2+10-1
25.0.3~5ea-1
25.0.3~5ea-2
25.0.3~7ea-1
25.0.3~7ea-2
25.0.3~8ea-1
25.0.3~8ea-2
25.0.3+9-1
25.0.3+9-2~deb13u1
25.0.3+9-2
25.0.4~4ea-1
25.0.4~6ea-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41254.json"
Debian:14
lcms2

Package

Name
lcms2
Purl
pkg:deb/debian/lcms2?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.17-1.1

Affected versions

2.*
2.16-2
2.17-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41254.json"
openjdk-21

Package

Name
openjdk-21
Purl
pkg:deb/debian/openjdk-21?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
21.0.12+8-1

Affected versions

21.*
21.0.8+9-1
21.0.9~5ea-1
21.0.9~8ea-1
21.0.9+10-1~deb13u1
21.0.9+10-1
21.0.10~4ea-1
21.0.10~6ea-1
21.0.10+7-1~deb13u1
21.0.10+7-1
21.0.11~5ea-1
21.0.11~6ea-1
21.0.11~8ea-1
21.0.11~9ea-1
21.0.11~9ea-2
21.0.11+10-1~deb13u1
21.0.11+10-1~deb13u2
21.0.11+10-1
21.0.12~5ea-1
21.0.12~7ea-1
21.0.12+8-1~deb13u1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41254.json"
openjdk-25

Package

Name
openjdk-25
Purl
pkg:deb/debian/openjdk-25?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
25.0.4+7-1

Affected versions

Other
25~32ea-1
25~34ea-1
25~36ea-1
25+36-1
25.*
25.0.1+8-1~deb13u1
25.0.1+8-1
25.0.1+8-2
25.0.1+8-3
25.0.2+10-1~deb13u2
25.0.2+10-1
25.0.3~5ea-1
25.0.3~5ea-2
25.0.3~7ea-1
25.0.3~7ea-2
25.0.3~8ea-1
25.0.3~8ea-2
25.0.3+9-1
25.0.3+9-2~deb13u1
25.0.3+9-2
25.0.4~4ea-1
25.0.4~6ea-1
25.0.4+7-1~deb13u1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41254.json"
openjdk-26

Package

Name
openjdk-26
Purl
pkg:deb/debian/openjdk-26?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
26.0.2+10-1

Affected versions

Other
26~9ea-1
26~12ea-1
26~17ea-1
26~21ea-1
26~22ea-1
26~22ea-2
26~26ea-1
26~28ea-1
26~30ea-1
26~32ea-1
26~34ea-1
26~35ea-1
26+35-1
26+35-2
26+35-3
26.*
26.0.1+8-1
26.0.1+8-2
26.0.1+8-3
26.0.1+8-4

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41254.json"