libsdl-org SDL_image up to 762 XCF Image Parser src/IMG_xcf.c do_layer_surface out-of-bounds

Summaryinfo

A vulnerability was found in libsdl-org SDL_image up to 762. It has been declared as critical. This affects the function do_layer_surface of the file src/IMG_xcf.c of the component XCF Image Parser. The manipulation results in out-of-bounds. This vulnerability is cataloged as CVE-2026-35444. The attack may be launched remotely. There is no exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in libsdl-org SDL_image up to 762. It has been classified as critical. Affected is the function do_layer_surface of the file src/IMG_xcf.c of the component XCF Image Parser. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-35444 since 04/02/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 321864 (Fedora 44 : mingw-SDL2_image (2026-6f328b5020)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 996bf12888925932daace576e09c3053410896f8 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Tenable (321864). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• libsdl-org

Name

• SDL_image

Version

• 762

Website

• Product: https://github.com/libsdl-org/SDL_image/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion