CVE-2008-5317: Littlecms Lcms

High severity, CVSS 10.0. EPSS: 2.2% chance of exploitation in the next 30 days.

Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers to have an unknown impact via a file containing a certain "number of entries" value, which is interpreted improperly, leading to an allocation of insufficient memory.

Affected products

• Littlecms Lcms: up to and including 1.16; version 1.07 only; version 1.08 only; version 1.09 only; version 1.10 only; version 1.11 only; …
• Littlecms Little CMS Color Engine: up to and including 1.16; version 1.07 only; version 1.08 only; version 1.09 only; version 1.10 only; version 1.11 only; …

Published 2008-12-03. Last modified 2026-06-16.