Log in Start free

Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-35444SDL_image has a heap buffer overflow READ via unchecked colormap index in XCF loader

High 7.1

In plain English

A high-severity out-of-bounds read in SDL_image from libsdl-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.3%top 81.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libsdl2-imageno fix listedDEBIAN-CVE-2026-35444
Debian:13libsdl2-image2.8.8+dfsg-1+deb13u1DEBIAN-CVE-2026-35444
Debian:14libsdl2-image2.8.10+dfsg-1DEBIAN-CVE-2026-35444
Debian:13libsdl3-image3.2.4+ds-1+deb13u1DEBIAN-CVE-2026-35444
Debian:14libsdl3-image3.4.2+ds-1DEBIAN-CVE-2026-35444
Debian:12sdl-image1.2no fix listedDEBIAN-CVE-2026-35444
Debian:13sdl-image1.2no fix listedDEBIAN-CVE-2026-35444
Debian:14sdl-image1.2no fix listedDEBIAN-CVE-2026-35444
Ubuntu:22.04:LTSlibsdl2-imageno fix listedUBUNTU-CVE-2026-35444
Ubuntu:24.04:LTSlibsdl2-imageno fix listedUBUNTU-CVE-2026-35444
Ubuntu:25.10libsdl2-imageno fix listedUBUNTU-CVE-2026-35444
Ubuntu:26.04:LTSlibsdl2-imageno fix listedUBUNTU-CVE-2026-35444
Ubuntu:26.10libsdl2-imageno fix listedUBUNTU-CVE-2026-35444
Ubuntu:25.10libsdl3-imageno fix listedUBUNTU-CVE-2026-35444
Ubuntu:26.04:LTSlibsdl3-imageno fix listedUBUNTU-CVE-2026-35444
Ubuntu:26.10libsdl3-imageno fix listedUBUNTU-CVE-2026-35444
Ubuntu:22.04:LTSsdl-image1.2no fix listedUBUNTU-CVE-2026-35444
Ubuntu:24.04:LTSsdl-image1.2no fix listedUBUNTU-CVE-2026-35444
Ubuntu:25.10sdl-image1.2no fix listedUBUNTU-CVE-2026-35444
Ubuntu:26.04:LTSsdl-image1.2no fix listedUBUNTU-CVE-2026-35444
Ubuntu:26.10sdl-image1.2no fix listedUBUNTU-CVE-2026-35444

Affected products (as reported)

VendorProductVersions
libsdl-org SDL_image < 996bf12888925932daace576e09c3053410896f8

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

References