CVE-2025-29070

What it actually does

Heap buffer overflow in smooth2() within cmsgamma.c of lcms2-2.16 that can result in denial of service when the function is invoked.

Why it matters to the business

Potential service disruption for applications relying on the affected library version, though the supplier states the code path is not exercised during normal operation, limiting practical risk.

How an attack unfolds

An attacker supplies input designed to reach the vulnerable smooth2 helper function, triggering the overflow and crash; the supplier notes this function exists only for low-level investigation and is never called in standard color management workflows.

How to fix it

Upgrade paddlepaddle to version 2.6.0 or later, which incorporates the corrected lcms2 dependency.

How to confirm the fix worked

Confirm paddlepaddle package version is 2.6.0 or newer and verify the embedded lcms2 library no longer contains the reported flaw.

Typical attack path

1. Identify an entry point that can reach the lcms2 smooth2 helper
2. Craft input that overflows the heap buffer
3. Trigger denial of service via crash

How to detect it

Search application and system logs for unexpected crashes or segmentation faults originating from lcms2 or paddlepaddle color-management code paths.

What your security team should do

• Apply the 2.6.0 paddlepaddle update across all environments
• Review dependency manifests for any remaining lcms2-2.16 references
• Monitor upstream lcms2 advisories for future changes