CVE-2025-29070: A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because "this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation."
Overview
- Severity
- Medium (CVSS 5.3)
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Exploit Status
- Not Exploited
- Patch Tuesday
- 2026-Aug
- Released
- 2026-08-07
- EPSS Score
- 0.91% (percentile: 56.5%)
Affected Products (2)
Open Source Software
- cbl2 lcms2 2.13.1-2
- azl3 lcms2 2.15-1 on Azure Linux 3.0
Revision History
- 2026-08-07: Information published.