SecOps SignalSecurity Intelligence Workspace
Collection Degraded30 / 46 Sources HealthyPublic Intel Only
Vulnerabilities/CVE-2016-10165Public Intelligence Dossier
Source: littlecms · Limited verification•Last verified: •Collection Degraded
CVE-2016-10165Unknown / EvaluatingHIGH (raw)CVSS 7.1CWE-125

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

Published: 04 Feb 2017•Last updated: 15 Oct 2026, 09:47 PM IST•Source identifier: cve@mitre.org
Dossier completeness: source-provided sections 2 / 3 · rule guidance not available. Missing source facts count as incomplete.
Official source
CISA KEV catalog
Unknown
KEV status was not determined.
CVSS score
7.1HIGH (raw)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Metric sourcenvd@nist.gov
EPSS probability
2.8%0.028
Percentile86th
Weakness type
CWE-125
No further CWE recorded
Remediation
Patch status unknown
No fixed version or KB recorded

Why It Matters

Analysis dossier

Why It Matters

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

SOC priority

High

Actively exploited

Unknown

Publicly disclosed

Unknown

Risk basis: Microsoft or Microsoft-managed product relevance; HIGH severity; No confirmed exploitation signal in current enrichment

Affected Products & Remediation

19 source-backed products
Affected products and versions (source)
  • littlecms little cms color engine · < 2.11 · NVD CPE · Source
  • canonical ubuntu linux · 12.04; 14.04; 16.04; 18.04 · NVD CPE · Source
  • debian debian linux · 8.0 · NVD CPE · Source
  • opensuse leap · 42.1 · NVD CPE · Source
  • redhat satellite · 5.8 · NVD CPE · Source
  • redhat enterprise linux desktop · 5.0; 6.0; 7.0 · NVD CPE · Source
  • redhat enterprise linux server · 5.0; 6.0; 7.0; aus 7.3; aus 7.4; aus 7.6; aus 7.7; eus 7.3; eus 7.4; eus 7.5; eus 7.6; eus 7.7; tus 7.3; tus 7.6; tus 7.7 · NVD CPE · Source
  • redhat enterprise linux server aus · 7.3; 7.4; 7.6; 7.7 · NVD CPE · Source
  • redhat enterprise linux server eus · 7.3; 7.4; 7.5; 7.6; 7.7 · NVD CPE · Source
  • redhat enterprise linux server tus · 7.3; 7.6; 7.7 · NVD CPE · Source
  • redhat enterprise linux workstation · 5.0; 6.0; 7.0 · NVD CPE · Source
  • netapp active iq unified manager · >= 7.3; >= 9.5 · NVD CPE · Source
  • netapp e-series santricity management · version range not provided by source · NVD CPE · Source
  • netapp e-series santricity os controller · 11.0; 11.0.0; 11.20; 11.25; 11.30; 11.30.5r3; 11.40; 11.40.3r2; 11.40.5 · NVD CPE · Source
  • netapp oncommand balance · version range not provided by source · NVD CPE · Source
  • netapp oncommand insight · version range not provided by source · NVD CPE · Source
  • netapp oncommand performance manager · version range not provided by source · NVD CPE · Source
  • netapp oncommand shift · version range not provided by source · NVD CPE · Source
  • netapp oncommand unified manager · version range not provided by source · NVD CPE · Source
Recorded patch / KBNot provided by source

Vendor or catalog guidance (source)

Not provided by source

Known exploitation (source facts)

Only what a source states. Unknown means no source has said either way; it is not "not exploited".

CISA KEV
Unknown
Exploited (source statement)
Unknown
Publicly disclosed (source)
Unknown

Suggested hunting (rule-based inference)

SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.

No rule-based guidance for this vulnerability class

CISA KEV Record

CISA KEV status was not determined for this record.

Change History & Source Data

— No recorded material change

CNA / source
cve@mitre.org
Record status · verification
UPDATED · NVD API
CPE
cpe:2.3:a:littlecms:little_cms_color_engine:*:*:*:*:*:*:*:*, cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*, cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*, cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*, cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*, cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*, cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*, cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

Evidence & Provenance

3 public sources
nvd.nist.govSource recordaccess.redhat.comSource recordaccess.redhat.comSource record

Linked by the query's stored exact CVE association. Review required tables and validation status before use.

Detection Hunting Query
Target: DeviceTvmSoftwareVulnerabilities•Defender XDR
Detect endpoints exposed to CVE-2016-10165
Purpose: Exposure assessment (Category: Exposure Check)Why linked: Query metadata names CVE-2016-10165
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2016-10165"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel desc
Schema Checked · Not runtime validatedSource: SecOps Signal deterministic template · Limited verificationStatic screening: Passed structure and schema checks; tenant execution is not verified.
Open KQL Library

Correlated briefings

— No published briefing references this CVE

SecOps Signal surfaces public advisory facts only. A missing value means the source has not published it, not that your environment is unaffected. No tenant inventory is connected.