High 7.1Published Feb 3, 2017

CVE-2016-10165The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which…

Updated under an hour ago (Oct 27, 2026, 2:30 AM ET)

Does this affect you?

It affects littlecms little_cms_color_engine and 18 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for littlecms little_cms_color_engine

Exploited in the last 30 days

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: mitre
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

littlecms little_cms_color_engine littlecms:little_cms_color_engine	before 2.11	NVD
canonical ubuntu_linux canonical:ubuntu_linux	12.04; 14.04; 16.04; 18.04	NVD
debian debian_linux debian:debian_linux	8.0	NVD
opensuse leap opensuse:leap	42.1	NVD
redhat satellite redhat:satellite	5.8	NVD
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop	5.0; 6.0; 7.0	NVD
redhat enterprise_linux_server redhat:enterprise_linux_server	5.0; 6.0; 7.0	NVD
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus	7.3; 7.4; 7.6; 7.7	NVD
redhat enterprise_linux_server_eus redhat:enterprise_linux_server_eus	7.3; 7.4; 7.5; 7.6; 7.7	NVD
redhat enterprise_linux_server_tus redhat:enterprise_linux_server_tus	7.3; 7.6; 7.7	NVD
1–10 of 19

References

References

https://usn.ubuntu.com/3770-2/	vendor-advisory, x-refsource-ubuntu, third-party-advisory
http://www.debian.org/security/2017/dsa-3774	vendor-advisory, x-refsource-debian, third-party-advisory
http://rhn.redhat.com/errata/RHSA-2016-2079.html	vendor-advisory, x-refsource-redhat, third-party-advisory
https://usn.ubuntu.com/3770-1/	vendor-advisory, x-refsource-ubuntu, third-party-advisory
https://access.redhat.com/errata/RHSA-2017:3267	vendor-advisory, x-refsource-redhat, third-party-advisory
https://access.redhat.com/errata/RHSA-2017:3268	vendor-advisory, x-refsource-redhat, third-party-advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	x-refsource-confirm, patch
https://access.redhat.com/errata/RHSA-2017:3046	vendor-advisory, x-refsource-redhat, third-party-advisory
http://lists.opensuse.org/opensuse-updates/2017-01/msg00174.html	vendor-advisory, x-refsource-suse, third-party-advisory
http://www.securityfocus.com/bid/95808	vdb-entry, x-refsource-bid, third-party-advisory
1–10 of 19

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.