CVE-2026-117557: SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader
Published Oct 27, 2026
·Updated
SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO() in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.
Affected Software
1 affected component
SDL SDL_image<=3.4.8, <=2.8.12
Event History
Oct 27, 2026
CVE Published
via MITRE·01:07 PM
Data Sourced
via MITRE·01:07 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
Deployments using SDL_image versions through 3.4.8 or through 2.8.12 are affected when they load ILBM files through IMG_LoadLBM_IO().
2
What does exploitation require?
An attacker needs to provide a crafted ILBM file that uses HAM mode and specifies more than 8 bitplanes. User interaction is required for the malicious file to be loaded.
3
What is the impact if exploitation succeeds?
The out-of-bounds read can cause a crash and may disclose stack memory.