Description
A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because "this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lcms2 | No fix yet | — |
| Debian 13 | lcms2 | No fix yet | — |
| Debian 12 | lcms2 | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | lcms2 +2 | 2.16-74.amzn2023 | ALAS2023-2026-1474 |
| Amazon Linux 2 | lcms2 +2 | 2.6-3.amzn2.0.3 | ALAS2-2026-3192 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | openjpeg2 | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | openjpeg2 | No fix yet | — |
Advisories 2
- ALAS2023-2026-1474 Moderate: lcms2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 27, 2026
- ALAS2-2026-3192 Moderate: lcms2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 19, 2026