CVE-2025-29070: lcms2 Debian Heap-based Buffer Overflow

Vulnerability summary

CVE-2025-29070 is a high (CVSS 7.5) Heap-based Buffer Overflow vulnerability in lcms2 Debian. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 60.7% of scored vulnerabilities.

Timeline

1. 01-04-2025
   PublishedVulnerability first disclosed.
2. 04-04-2025
   Last modifiedVulnerability information updated.

Description

A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because "this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation."

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().