CVE-2018-16435

Name of the Vulnerable Software and Affected Versions Little CMS version 2.9

Description The issue is related to an integer overflow in the AllocateDataSet function in cmscgats.c, which leads to a heap-based buffer overflow in the SetData function. This can be triggered via a crafted file passed as the second argument to cmsIT8LoadFromFile, potentially allowing a remote attacker to cause a denial of service or execute arbitrary code.

Recommendations For Little CMS version 2.9, consider disabling the AllocateDataSet function or restricting the use of cmsIT8LoadFromFile until a patch is available to prevent potential exploitation.