CVE-2026-117557 in SDL_image
Summary
by MITRE • 10/27/2026
SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within SDL_image versions up through 3.4.8 and 2.8.12 represents a critical security flaw located in the IMG_LoadLBM_IO function found in the src/IMG_lbm.c source file. This library is widely used for loading various image formats, including the Interleaved Bitmap format commonly associated with older Amiga systems. The core technical issue stems from an insufficient validation of input data during the parsing process specifically when handling High Color Mode or HAM mode images. In standard LBM processing, bitplane counts are typically constrained to ensure that memory allocations and subsequent read operations remain within safe boundaries. However, in this specific implementation, the code fails to enforce a strict upper limit on the number of bitplanes when the file header indicates HAM mode is active. This oversight allows an attacker to craft a malicious ILBM file that declares more than eight HAM bitplanes, which exceeds the expected capacity for standard color depth handling in many contexts or triggers logic errors if the implementation assumes a fixed maximum regardless of mode.
From a technical perspective, this flaw manifests as a stack-based out-of-bounds read vulnerability. When the library processes such a crafted file, it attempts to access memory locations beyond the allocated colormap array on the call stack. Because C does not perform automatic bounds checking for array accesses, the program continues reading from adjacent memory regions that were intended for other local variables or return addresses. This behavior directly aligns with Common Weakness Enumeration CWE-125, which describes out-of-bounds read operations where software reads data past the end of a buffer. The consequence of this memory violation is twofold: it can lead to immediate application crashes due to segmentation faults if the accessed memory is unmapped or protected by the operating system's virtual memory manager, and more critically, it enables information disclosure. By carefully controlling the crafted input, an attacker may be able to leak sensitive data stored on the stack, such as encryption keys, session tokens, or other private user information that resides in adjacent memory slots relative to the colormap buffer.
The operational impact of this vulnerability is significant for any application relying on SDL_image to render untrusted image content. Since LBM files are often used in legacy game assets and retro computing environments, they may be encountered unexpectedly during normal usage if an attacker can inject a malicious file into the user's directory or serve it via a web-based asset loader. The ability to cause denial of service through application crashes affects availability, while the potential for stack memory disclosure compromises confidentiality. In terms of threat modeling, this vulnerability facilitates exploitation techniques categorized under MITRE ATT&CK technique T1059, specifically command execution if combined with other vulnerabilities like buffer overflows that allow code injection, although in its current state as a read-only flaw, it primarily serves reconnaissance and information gathering purposes. Attackers could use the leaked stack data to fingerprint the environment or extract cryptographic material necessary for further attacks against the host system.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary remediation is to upgrade SDL_image to a version that includes patches addressing this specific validation gap, ensuring that developers are using maintained software with active security support. For applications unable to update immediately, input sanitization at the application layer can serve as a temporary workaround by validating image headers before passing them to the library, specifically checking bitplane counts against expected limits for HAM mode files. Furthermore, integrating static analysis tools and fuzzing campaigns into the development lifecycle is recommended to detect similar logic errors in other parsers within the codebase. Developers should also consider enabling compiler protections such as stack canaries and Address Sanitizer during testing phases to identify out-of-bounds accesses early. Adhering to secure coding standards that mandate explicit bounds checking for all array operations, particularly those derived from external file formats, will prevent recurrence of CWE-125 type vulnerabilities in future development cycles.