Live › vulnerability › CVE-2026-117557
Go to dashboardSDL_image's IFF/ILBM image loader does not validate the bitplane count when HAM mode is set, so a crafted file with more than 8 bitplanes reads past a stack colormap array. An attacker can crash an application that opens the file or leak nearby stack memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Applications that link SDL_image 3.4.8 or earlier, or 2.8.12 or earlier, and decode ILBM images from untrusted input such as user uploads, game assets from third parties or downloaded files. Systems that only load their own bundled assets or never decode ILBM files are unlikely to be exposed.
No product ranges from the sources yet.
pkg-config --modversion SDL2_image or the version constant in the bundled SDL_image headers.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-117557")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.