CVE-2018-11556

HIGH

Little CMS 2.9 - Out-of-bounds Write via Crafted TIFF File

Title source: llm
STIX 2.1

Description

tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider this a vulnerability because the issue is based on an sample program using LIBTIFF and do not apply to the lcms2 library, lcms2 does not depends on LIBTIFF other than to build sample programs, and the issue cannot be reproduced on the lcms2 library.”

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://github.com/mm2/Little-CMS/issues/167

Scores

CVSS v3 7.8
EPSS 0.0107
EPSS Percentile 60.4%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (1)
littlecms/little_cms 2.9
Published May 30, 2018
Tracked Since Feb 18, 2026