DEBIAN-CVE-2026-117557: Medium severity debian/libsdl2-image vulnerability

Published Oct 27, 2026

Updated

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO() in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.

Affected Software

8 affected components

debian/libsdl2-image*

debian/libsdl3-image*

debian/sdl-image1.2*

Event History

Oct 27, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Debian packages should be reviewed for exposure?

Review deployments using debian/libsdl2-image, debian/sdl-image1.2, or debian/libsdl3-image, particularly where applications load ILBM image files.

What must an attacker provide to trigger the issue?

An attacker must supply a crafted ILBM file that uses HAM mode and declares more than 8 HAM bitplanes. The issue is reached while the file is processed by the affected LBM image-loading code.

What is the practical impact of successful exploitation?

Successful exploitation can cause an application crash or disclose stack memory by reading beyond the colormap stack array. The provided severity vector indicates no attacker privileges are required, but user interaction is required.

DEBIAN-CVE-2026-117557: Medium severity debian/libsdl2-image vulnerability

Affected Software

Event History

Frequently Asked Questions

Which Debian packages should be reviewed for exposure?

What must an attacker provide to trigger the issue?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Debian packages should be reviewed for exposure?

What must an attacker provide to trigger the issue?

What is the practical impact of successful exploitation?