Medium severity · published Oct 27, 2026
CVE-2026-117557
SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader
New
6.1
CVSS
–
EPSS
No
On KEV
Description
SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
SDL_image · libsdl-org
through 2.8.12; 3.0.0 through 3.4.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117557
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117557
github.com
https://github.com/libsdl-org/SDL_image
github.com
https://github.com/libsdl-org/SDL_image/blob/release-3.4.8/src/IMG_lbm.c#L240
github.com
https://github.com/libsdl-org/SDL_image/commit/5cfbe85f3a783417eec4d5aa0660b40c2cff5292
github.com
https://github.com/libsdl-org/SDL_image/commit/9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996
github.com
https://github.com/libsdl-org/SDL_image/issues/769
www.vulncheck.com
https://www.vulncheck.com/advisories/sdl-image-through-3.4.8-and-2.8.12-stack-out-of-bounds-read-in-ilbm-loader
More from SDL_image
6.1
CVE-2026-35444
SDL_image has a heap buffer overflow READ via unchecked colormap index in XCF loader