CVE-2025-29070: Buffer Overflow
A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because "this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation."
Affected Software
Event History
Frequently Asked Questions
What is CVE-2025-29070?
CVE-2025-29070 is a heap buffer overflow vulnerability in the thesmooth2() function in cmsgamma.c within lcms2-2.16, which can lead to denial of service if exploited.
What causes CVE-2025-29070?
CVE-2025-29070 is caused by improper handling of memory allocations in the thesmooth2() function, leading to a buffer overflow.
How do I fix CVE-2025-29070?
To fix CVE-2025-29070, update to the latest version of lcms2 that addresses this vulnerability and improves memory management.
What are the impacts of CVE-2025-29070?
The impacts of CVE-2025-29070 include potential denial of service, which can disrupt normal operations of applications using lcms2.
Is CVE-2025-29070 exploitable in standard use cases?
The supplier claims that CVE-2025-29070 is not exploitable in normal color management scenarios since the affected function is rarely called.