p PatchFirst

CVE-2026-35444

CVE-2026-35444 · SDL_image has a heap buffer overflow READ via unchecked colormap index in XCF loader

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.

CVSS 7.1 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • sdl_image

    Versions
    • < 996bf12888925932daace576e09c3053410896f8: Affected

    No fix published

  • libsdl2-image Debian:12

    Versions
    • 2.6.3+dfsg-1
    • 2.6.3+dfsg-2
    • 2.8.0+dfsg-1
    • 2.8.1+dfsg-1
    • 2.8.10+dfsg-1
    • 2.8.12+dfsg-1
    • 2.8.12+dfsg-2
    • 2.8.2+dfsg-1
    • 2.8.4+dfsg-1
    • 2.8.5+dfsg-1
    • 2.8.6+dfsg-1
    • 2.8.6+dfsg-2
    • 2.8.8+dfsg-1
    • 2.8.8+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libsdl2-image Debian:13

    Versions
    • 2.8.8+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 2.8.8+dfsg-1+deb13u1

    Update to 2.8.8+dfsg-1+deb13u1

  • libsdl2-image Debian:14

    Versions
    • 2.8.8+dfsg-1
    • 2.8.8+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 2.8.10+dfsg-1

    Update to 2.8.10+dfsg-1

  • libsdl3-image Debian:13

    Versions
    • 3.2.4+ds-1
    Affected ranges
    • ECOSYSTEM: < 3.2.4+ds-1+deb13u1

    Update to 3.2.4+ds-1+deb13u1

  • libsdl3-image Debian:14

    Versions
    • 3.2.4+ds-1
    • 3.2.6+ds-1
    • 3.3.4+ds-1
    • 3.3.4+ds-2
    • 3.4.0+ds-1
    Affected ranges
    • ECOSYSTEM: < 3.4.2+ds-1

    Update to 3.4.2+ds-1

  • sdl-image1.2 Debian:12

    Versions
    • 1.2.12-13
    • 1.2.12-14
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sdl-image1.2 Debian:13

    Versions
    • 1.2.12-14
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sdl-image1.2 Debian:14

    Versions
    • 1.2.12-14
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libsdl2-image Ubuntu:Pro:14.04:LTS

    Versions
    • 2.0.0+dfsg-2
    • 2.0.0+dfsg-3
    • 2.0.0+dfsg-3build2
    • 2.0.0+dfsg-3+deb8u1build0.14.04.1
    • 2.0.0+dfsg-3+deb8u2build0.14.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sdl-image1.2 Ubuntu:Pro:14.04:LTS

    Versions
    • 1.2.12-4ubuntu1
    • 1.2.12-5
    • 1.2.12-5build2
    • 1.2.12-5+deb9u1build0.14.04.1
    • 1.2.12-5+deb9u1ubuntu0.14.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libsdl2-image Ubuntu:16.04:LTS

    Versions
    • 2.0.0+dfsg-3build2
    • 2.0.1+dfsg-1
    • 2.0.1+dfsg-2
    • 2.0.1+dfsg-2+deb9u1build0.16.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sdl-image1.2 Ubuntu:16.04:LTS

    Versions
    • 1.2.12-5build2
    • 1.2.12-5+deb9u1build0.16.04.1
    • 1.2.12-5+deb9u1ubuntu0.16.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libsdl2-image Ubuntu:18.04:LTS

    Versions
    • 2.0.1+dfsg-3
    • 2.0.1+dfsg-4
    • 2.0.2+dfsg1-1
    • 2.0.3+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sdl-image1.2 Ubuntu:18.04:LTS

    Versions
    • 1.2.12-6
    • 1.2.12-7
    • 1.2.12-8
    • 1.2.12-8ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libsdl2-image Ubuntu:20.04:LTS

    Versions
    • 2.0.5+dfsg1-1
    • 2.0.5+dfsg1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sdl-image1.2 Ubuntu:20.04:LTS

    Versions
    • 1.2.12-12
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libsdl2-image Ubuntu:22.04:LTS

    Versions
    • 2.0.5+dfsg1-2
    • 2.0.5+dfsg1-3
    • 2.0.5+dfsg1-3build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sdl-image1.2 Ubuntu:22.04:LTS

    Versions
    • 1.2.12-12
    • 1.2.12-13
    • 1.2.12-13build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libsdl2-image Ubuntu:24.04:LTS

    Versions
    • 2.6.3+dfsg-2
    • 2.8.0+dfsg-1
    • 2.8.1+dfsg-1
    • 2.8.2+dfsg-1
    • 2.8.2+dfsg-1build1
    • 2.8.2+dfsg-1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sdl-image1.2 Ubuntu:24.04:LTS

    Versions
    • 1.2.12-13build2
    • 1.2.12-13build3
    • 1.2.12-13build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libsdl2-image Ubuntu:25.10

    Versions
    • 2.8.8+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libsdl3-image Ubuntu:25.10

    Versions
    • 3.2.4+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • sdl-image1.2 Ubuntu:25.10

    Versions
    • 1.2.12-14
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →