CVE-2026-41254: 
OpenJDK JDK vulnerability analysis and mitigation

CVE-2026-41254 is an integer overflow vulnerability in Little CMS (lcms2) through version 2.18, located in the CubeSize() function in src/cmslut.c. The flaw exists because the overflow check is performed after the multiplication rather than before, allowing integer wraparound to go undetected. It affects all released versions of lcms2 up to and including 2.18, with downstream impact on any application linking against the library (Poppler, OpenJDK, GIMP, CUPS, Okular, etc.). Disclosed publicly on April 17–18, 2026 via the oss-security mailing list and GitHub Advisory Database, it carries a CVSS v3.1 score of 7.5 (High) under a network/no-auth/no-interaction scenario (Github Advisory, oss-security).

The root cause is CWE-190 (Integer Overflow or Wraparound) compounded by CWE-696 (Incorrect Behavior Order): in CubeSize(), the accumulator rv was declared as cmsUInt32Number and multiplied by each CLUT dimension before the guard rv > UINT_MAX / dim was evaluated, meaning a wrapped result could pass the check undetected (oss-security, Patch commit da6110b). A crafted ICC profile with CLUT dimensions such as [61, 7, 161, 245, 255] produces a true product exceeding 2^32 that wraps to a small value (~1,529), causing cmsStageAllocCLut16bitGranular() to allocate a severely undersized buffer (~9 KB instead of ~10 GB); the interpolator then indexes past the buffer during transform construction or cmsDoTransform, triggering a SIGSEGV (CWE-125 out-of-bounds read) (oss-security). The vulnerability is reachable via any user-supplied file (PDF, ICC profile) processed by an lcms2-linked application, requiring no authentication or privileges. A public PoC — a 992-byte PDF — is available and confirmed to crash multiple real-world applications (PoC write-up).

The primary impact is denial of service: a malformed ICC profile or PDF causes a SIGSEGV crash in any application using lcms2, including Poppler (pdftoppm, pdftocairo), evince-thumbnailer, GIMP, Okular, CUPS pdftoraster, OpenJDK 21 (both Linux system-linked and Windows-bundled lcms.dll), and the tumblerd D-Bus thumbnail daemon (oss-security). A secondary, limited information-disclosure primitive (CWE-200) was also demonstrated on Linux with ASLR disabled: the first output byte of cmsDoTransform correlates with a heap-seed byte in the range [-365 KB, -1.5 KB] below the CLUT allocation, constituting a coarse heap-read side channel, though not an arbitrary read (oss-security). Server-side rendering pipelines (e.g., Flask/Docker PDF thumbnailers, webmail preview services) are particularly exposed since no user interaction is required on the server side.

A public proof-of-concept exploit — a 992-byte PDF (poc_iccbased_5ch.pdf, SHA256: 5c328a4362185c6dca2d6cae13c74ed456889798220f3f16e840449648121b55) — is available and confirmed to crash Poppler, OpenJDK 21, GIMP, Okular, CUPS, and tumblerd on stock Ubuntu 24.04 LTS and Windows Server 2022 with Temurin 21.0.9 (PoC write-up, oss-security). A minimal C reproducer is also publicly documented. There is no evidence of in-the-wild exploitation or threat actor attribution at this time (Github Advisory). The EPSS score is approximately 0.013% (very low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA KEV catalog. Nessus detection plugins 307441, 313713, and 315639 are available.

1. Craft or obtain the malicious file: Use the publicly available 992-byte PoC PDF (poc_iccbased_5ch.pdf) or craft an ICC profile with a 5-channel CLUT using dimensions [61, 7, 161, 245, 255] that cause integer wraparound in CubeSize(). The SHA256 of the known PoC is 5c328a4362185c6dca2d6cae13c74ed456889798220f3f16e840449648121b55 (PoC write-up).
2. Identify a target application: Locate a service that processes user-supplied PDFs or ICC profiles using lcms2 ≤ 2.18 — e.g., a web-based PDF thumbnail service (Poppler-backed), a print server (CUPS), or a Java application using ICC_Profile.getInstance() (oss-security).
3. Deliver the malicious file: Upload the PoC PDF to the target service (e.g., HTTP upload endpoint, email attachment, shared folder). For the D-Bus tumblerd path, issue: dbus-send --session --dest=org.freedesktop.thumbnails.Thumbnailer1 /org/freedesktop/thumbnails/Thumbnailer1 org.freedesktop.thumbnails.Thumbnailer1.Queue ... with the PDF URI.
4. Trigger processing: For Poppler: pdftoppm poc_iccbased_5ch.pdf /tmp/out → SIGSEGV. For OpenJDK: call ICC_Profile.getInstance(bytes) followed by ICC_ColorSpace.toRGB(). For CUPS: /usr/lib/cups/filter/pdftoraster 1 root "" 1 "" < poc.pdf.
5. Observe crash (DoS achieved): The target process crashes with SIGSEGV inside liblcms2.so at Eval4Inputs+643 (cmsintrp.c:909), causing denial of service for the affected application or daemon (oss-security).

• Logs: Kernel dmesg entries of the form <process>[PID]: segfault at <addr> in liblcms2.so.2.0.14[0xb503]; apport crash records for evince-thumbnailer, pdftoppm, pdftocairo, Okular, or pdftoraster referencing liblcms2; Java crash logs showing EXCEPTION_ACCESS_VIOLATION in lcms.dll+0x9fd2 on Windows.
• Process: Unexpected SIGSEGV termination of tumblerd, pdftoppm, pdftocairo, pdfimages, okular, pdftoraster, gimp, or Java processes; HTTP 500 responses with exit_code:-11 from PDF thumbnail/rendering services.
• Network: Repeated upload requests of small PDF files (~992 bytes) to document preview, thumbnail, or print endpoints; unusual volume of failed rendering jobs from a single source IP.
• File System: Presence of a PDF file with SHA256 5c328a4362185c6dca2d6cae13c74ed456889798220f3f16e840449648121b55 (poc_iccbased_5ch.pdf) in upload directories or temporary folders; core dump files from lcms2-linked processes in /var/crash/ or /tmp/.

Update lcms2 to a version newer than 2.18 by applying the two upstream patches: commit da6110b (widens the rv accumulator from cmsUInt32Number to cmsUInt64Number) and commit e0641b1 (moves the overflow guard to before the multiplication). Distribution packages are available: Ubuntu (USN-8209-1/8209-2), Debian (DSA-6262-1, DLA-4568-1), Amazon Linux 2023 (ALAS2023-2026-1657), and Red Hat (Red Hat Advisory). As a workaround where patching is not immediately possible, restrict or sandbox applications that process untrusted PDF or ICC profile files, and implement input validation to reject ICC profiles with channel counts greater than 4 or suspicious CLUT dimension values.

The vulnerability was publicly disclosed by researcher Abhinav Agarwal on the oss-security mailing list on April 17, 2026, after the upstream maintainer closed the private GHSA without engagement (oss-security). The disclosure noted that upstream fixes had been committed to master in February–March 2026 but no release or advisory had been issued. Red Hat, Microsoft, Amazon Linux, Ubuntu, and Debian all subsequently issued security advisories, and the vulnerability received coverage from Linux security news outlets including LinuxSecurity.com and pro-linux.de (Github Advisory).