CVE-2013-4276: Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote atta...

Security readout for executives and security teams

CVE-2013-4276 affects old LittleCMS 1.x releases. A specially crafted ICC color profile or TIFF image can crash affected utilities, creating denial-of-service risk in workflows that process untrusted image or color-profile files. Exposure is most likely on systems still carrying LittleCMS 1.19 or earlier and using icctrans, tiffdiff, or dependent processing workflows on untrusted files. Modern systems may be unaffected if they no longer package lcms 1.x or have vendor fixes applied. Treat this as targeted maintenance unless untrusted image processing is business-critical. Prioritize internet-facing or automated file-ingestion environments first, because the documented impact is service crash rather than confirmed system compromise. Mitigation focus: Inventory hosts and containers for LittleCMS, lcms, or liblcms 1.19 and earlier.; Apply vendor security updates from the relevant Linux distribution or software supplier.; Restrict untrusted ICC, TIFF, and image-processing inputs until patched..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.