littlecms little cms color engine

• CVE-2026-42798 Medium 4.0 Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c. 0.1%
• CVE-2026-41254 Medium 4.0 Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. 0.4%