| Name | CVE-2026-117557 |
| Description | SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| libsdl2-image (PTS) | bookworm | 2.6.3+dfsg-1 | vulnerable |
| trixie | 2.8.8+dfsg-1+deb13u1 | vulnerable | |
| forky, sid | 2.8.12+dfsg-2 | vulnerable | |
| libsdl3-image (PTS) | trixie | 3.2.4+ds-1+deb13u1 | vulnerable |
| forky, sid | 3.4.8+ds-1 | vulnerable | |
| sdl-image1.2 (PTS) | bookworm | 1.2.12-13 | vulnerable |
| forky, sid, trixie | 1.2.12-14 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| libsdl2-image | source | (unstable) | (unfixed) | |||
| libsdl3-image | source | (unstable) | (unfixed) | |||
| sdl-image1.2 | source | (unstable) | (unfixed) |
[trixie] - libsdl3-image <no-dsa> (Minor issue)
[trixie] - libsdl2-image <no-dsa> (Minor issue)
[trixie] - sdl-image1.2 <no-dsa> (Minor issue)
https://github.com/libsdl-org/SDL_image/issues/769
Fixed by: https://github.com/libsdl-org/SDL_image/commit/5cfbe85f3a783417eec4d5aa0660b40c2cff5292 (main)
Fixed by: https://github.com/libsdl-org/SDL_image/commit/9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996 (release-3.4.x)