CVE-2013-7455

9.8 criticalEPSS 6.2%

Critical (9.8) in littlecms little cms color engine. EPSS 6.2% chance of exploitation in the next 30 days.

Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 6.2% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
Published: 2016-05-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

littlecms:little_cms_color_engine

References

http://www.kb.cert.org/vuls/id/369800
http://www.ubuntu.com/usn/USN-2961-1
https://github.com/mm2/Little-CMS/commit/fefaaa43c382eee632ea3ad0cfa915335140e1db
https://penteston.com/OSVDB-105462
http://www.kb.cert.org/vuls/id/369800

Check your stack JSON