CVE-2026-35444
MEDIUM EPSS 17.5%
Published Apr 6, 20262mo ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Published Apr 6, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago
Description
SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity None
Availability Low
Threat Intelligence
EPSS Exploit Probability
17.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-125 Out-of-bounds Read Memory Safety
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| libsdl | sdl_image | * | <2026-04-02 |
References 1
- github.com https://github.com/libsdl-org/SDL_image/security/advisories/GHSA-gq8w-x74c-h6p7
Remediation
- github.com https://github.com/libsdl-org/SDL_image/security/advisories/GHSA-gq8w-x74c-h6p7