Stack Out-of-Bounds Read Vulnerability in SDL_image Product by SDL

CVE-2026-117557

What is CVE-2026-117557?

SDL_image versions up to 3.4.8 and 2.8.12 contain a vulnerability in the IMG_LoadLBM_IO() function, which improperly validates the bitplane count when operating in HAM mode. This flaw allows attackers to craft malicious ILBM files with an excessive number of HAM bitplanes, enabling them to read beyond the designated colormap stack array. This can lead to application crashes or unauthorized disclosure of sensitive stack memory, thus raising significant concerns for system integrity and data security.

References