CVE-2026-117557
SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader
libsdl-org SDL_image
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.
Text from CVE List
Affected versions 2
- SDL_imageaffected: all versions through 2.8.12CVE List
- SDL_imageaffected: 3.0.0 through 3.4.8CVE List
References 6
- github.com/libsdl-org/SDL_image/commit/5cfbe85f3a783417eec4d5aa0660b40c2cff5292Fixvia CVE List
- github.com/libsdl-org/SDL_image/commit/9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996Fixvia CVE List
- vulncheck.com/advisories/sdl-image-through-3.4.8-and-2.8.12-stack-out-of-bounds-read-in-ilbm-loaderAdvisoryvia CVE List
- github.com/libsdl-org/SDL_image/issues/769Referencevia CVE List
- github.com/libsdl-org/SDL_imageReferencevia CVE List
- github.com/libsdl-org/SDL_image/blob/release-3.4.8/src/IMG_lbm.c#L240Referencevia CVE List