UBUNTU-CVE-2026-117557: Medium severity ubuntu/libsdl2-image vulnerability
SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO() in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must cause the vulnerable application to process a crafted ILBM file that uses HAM mode and specifies more than eight bitplanes. User interaction is required, and the attack is local according to the supplied vector.
What is the likely impact of a successful attack?
Processing the malformed file can read beyond the colormap stack array. This may crash the application or disclose stack memory; no integrity impact is indicated.
Which Ubuntu packages should be assessed?
Assess installations of ubuntu/libsdl2-image and ubuntu/libsdl3-image. The affected upstream SDL_image version ranges are through 2.8.12 and through 3.4.8.