{"id":"CVE-2026-117557","kind":"vulnerability","aliases":["CVE-2026-117557"],"related":[],"title":"SDL_image: crafted ILBM file reads past stack array in HAM mode","description":"SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.","summary":"SDL_image's IFF/ILBM image loader does not validate the bitplane count when HAM mode is set, so a crafted file with more than 8 bitplanes reads past a stack colormap array. An attacker can crash an application that opens the file or leak nearby stack memory.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","c++","games","image-processing","package","sdl"],"not_affected_if":["bundled-assets-only","no-untrusted-lbm-input"],"how_to_check":"- Check the installed SDL_image version with `pkg-config --modversion SDL2_image` or the version constant in the bundled SDL_image headers.\n- Check whether the application loads IFF/ILBM (.lbm) images through SDL_image.","fix":"- Move SDL_image past the fixed release for the affected branch; the sources do not name the fixed version, so unknown.\n- Until patched, do not load untrusted .lbm files through SDL_image.","status":"open","published_at":"2026-10-27T14:16:37+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:33:02+00:00","updated_at":"2026-10-27T14:33:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T14:33:02Z","model":"claude-haiku-5-5","output":{"fix":"- Move SDL_image past the fixed release for the affected branch; the sources do not name the fixed version, so unknown.\n- Until patched, do not load untrusted .lbm files through SDL_image.","reach":"unknown","title":"SDL_image: crafted ILBM file reads past stack array in HAM mode","impact":"medium","summary":"SDL_image's IFF/ILBM image loader does not validate the bitplane count when HAM mode is set, so a crafted file with more than 8 bitplanes reads past a stack colormap array. An attacker can crash an application that opens the file or leak nearby stack memory.","category":"package","nicknames":[],"who_cares":["sdl","c","c++","games","image-processing"],"confidence":0.6,"needs_auth":"no","worst_case":"Application crashes or leaks stack memory contents when it opens a crafted file.","analyst_note":"Confirm the fixed SDL_image versions for the 2.x and 3.x branches and whether untrusted input reaches IMG_LoadLBM_IO, using the NVD entry and the upstream SDL_image commit that touches src/IMG_lbm.c.","how_to_check":"- Check the installed SDL_image version with `pkg-config --modversion SDL2_image` or the version constant in the bundled SDL_image headers.\n- Check whether the application loads IFF/ILBM (.lbm) images through SDL_image.","needs_analyst":true,"not_affected_if":["no-untrusted-lbm-input","bundled-assets-only"],"who_is_affected":"Applications that link SDL_image 3.4.8 or earlier, or 2.8.12 or earlier, and decode ILBM images from untrusted input such as user uploads, game assets from third parties or downloaded files. Systems that only load their own bundled assets or never decode ILBM files are unlikely to be exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":3379,"output_tokens":672,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117557':15A,18A '-2026':14A,17A '2.8.12':80C '3.4.8':77C '8':51B,116C 'applic':64B 'array':9A,58B,125C 'attack':60B,106C 'bitplan':37B,52B,98C,118C 'bound':87C 'c':19B,20B 'caus':126C 'colormap':57B,123C 'contain':81C 'count':38B,99C 'craft':3A,46B,110C 'crash':62B,127C 'cve':13A,16A 'disclos':129C 'file':5A,47B,68B,112C 'game':21B 'ham':11A,40B,102C,117C 'iff/ilbm':30B 'ilbm':4A,111C 'imag':2A,23B,28B,31B,75C 'image-process':22B 'img':91C 'io':93C 'leak':70B 'loader':32B 'loadlbm':92C 'memori':73B,131C 'mode':12A,41B,103C 'nearbi':71B 'open':66B 'out-of-bound':84C 'packag':25B 'past':7A,54B,121C 'process':24B 'read':6A,53B,88C,120C 'sdl':1A,26B,27B,74C 'set':43B,105C 'skip':97C 'src/img_lbm.c':95C 'stack':8A,56B,72B,83C,124C,130C 'suppli':108C 'valid':35B,100C 'vulner':89C","nicknames":[],"mitigations":[],"who_affected":"Applications that link SDL_image 3.4.8 or earlier, or 2.8.12 or earlier, and decode ILBM images from untrusted input such as user uploads, game assets from third parties or downloaded files. Systems that only load their own bundled assets or never decode ILBM files are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117557","severity":null,"published_at":"2026-10-27T14:16:37+00:00","modified_at":"2026-10-27T14:16:37+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}