Little Cms
Vendor:
First CVE: Dec 17, 2008 · Active for 17 years
7
Total CVEs
More Total CVEs than 83% of tracked products
1.8
Avg CVEs / Year
Higher CVE frequency than 63% of tracked products
7.5
Avg CVSS
Higher Avg CVSS than 65% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Little Cms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 17, 2008
17 years ago
Most Recent CVE
Apr 18, 2026
101 days ago
CVE Severity & Scoring
Little Cms7 CVEs
29%
71%
All CVEs353,173 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local2 (28.6%)
Network1 (14.3%)
Unknown4 (57.1%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low3 (42.9%)
High0 (0.0%)
Unknown4 (57.1%)
User Interaction
None1 (14.3%)
Unknown4 (57.1%)
Required2 (28.6%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None3 (42.9%)
Unknown4 (57.1%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-41254HIGH Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. | Apr 18, 2026 | 7.5 | 30 | NO | NO |
CVE-2009-0733HIGH Multiple stack-based buffer overflows in the ReadSetOfCurves function in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow cont | Mar 23, 2009 | 9.3 | 28 | NO | NO |
CVE-2009-0723HIGH Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrar | Mar 23, 2009 | 9.3 | 28 | NO | NO |
CVE-2008-5628MEDIUM SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands via the term parameter. | Dec 17, 2008 | 6.8 | 26 | NO | YES |
CVE-2018-11556HIGH tificc in Little CMS 2.9 has an out-of-bounds write in the cmsPipelineCheckAndRetreiveStages function in cmslut.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers | May 30, 2018 | 7.8 | 24 | NO | NO |
CVE-2018-11555HIGH tificc in Little CMS 2.9 has an out-of-bounds write in the PrecalculatedXFORM function in cmsxform.c in liblcms2.a via a crafted TIFF file. NOTE: Little CMS developers do consider | May 30, 2018 | 7.8 | 23 | NO | NO |
CVE-2009-0581MEDIUM Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (mem | Mar 23, 2009 | 4.3 | 16 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
14.3% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Little Cms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.9 | 2 | 7.8 | 1.1% | 0 | 0 |
| 0.0.1 | 1 | 6.8 | 0.9% | 0 | 1 |