lcms2 CubeSize Integer Overflow Vulnerability and PoC

Vulnerability Overview Vulnerability Name: Integer overflow vulnerability in the function of Little CMS (lcms2). Vulnerability Description: The function calculates , and if values in the array cause multiplication overflow, it returns a wrapped value. The caller allocates a smaller CLUT buffer based on this incorrect value, but later processing reads beyond the buffer bounds, leading to a segmentation fault (SIGSEGV). Vulnerability Impact: This vulnerability can be exploited to crash applications such as Poppler and OpenJDK. Affected Scope Affected Versions: All released lcms2 version 2.18. Affected Systems: - Ubuntu 24.04 LTS - Debian bookworm - Fedora - Alpine Edge - Windows Server 2022 - macOS consumer path - Ghostscript 10 - ImageMagick - Pillow - libvips - Node.js - Python (ctypes) - Rust (lcms2 crate 5.6) Remediation Remediation Status: Fixed upstream, but no new version has been released yet. Fix Commits: - (February 2025) - (March 2025) Fix Content: Fixed the integer overflow issue in the function. POC Code Direct C POC 92-byte PDF Python (ctypes) Rust (5 lines after Cargo.toml) Information Disclosure (CWE-200) Vulnerability Description: On Ubuntu 24.04 LTS, using ASLR and glibc’s default allocator, the first output byte can be traced via pre-run stack bytes through . Impact: May lead to sensitive information disclosure. Summary This vulnerability is an integer overflow issue that may result in segmentation faults and information disclosure. Affected applications include Poppler, OpenJDK, etc. It has been fixed upstream, but no new version has been released yet.

Goal Reached Thanks to every supporter — we hit 100%!

lcms2 CubeSize Integer Overflow Vulnerability and PoC