🛡️ CVE-2026-42798 on BellSoft — lcms2

Distribution advisory

This page covers CVE-2026-42798 as tracked by BellSoft, for the package lcms2. The fix is available in version 2.19-r0; earlier versions remain affected.

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is high, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality low, integrity none, availability low.

Weakness class

BELL-CVE-2026-42798 is classified as CWE-190: Integer Overflow or Wraparound. Arithmetic produces a value too large for its type and wraps around, so a later size or bounds check passes when it should not.

Affected software

BELL-CVE-2026-42798 is recorded against 1 package.

• lcms2 (from 2.16-r0 up to 2.19-r0)

Timeline and source

Published on 6 May 2026 and last revised on 8 May 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

docs.bell-sw.com (Advisory)

CVE-2026-42798 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Affected Packages

References