EUVD-2026-110835
GHSA-m3v7-j67w-q2pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious ILBM file with HAM flag and >8 bitplanes
-
DeliveryDeliver image to victim SDL_image application
-
ExploitIMG_LoadLBM_IO skips HAM bitplane validation
-
ExecutionRead past colormap stack array
-
ImpactCrash process or leak stack memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an application using SDL_image (≤3.4.8 in the 3.x branch, or ≤2.8.12 in the 2.x branch) to load an attacker-supplied ILBM/LBM image in which the CAMG HAM flag is set AND the bitplane count (nbplanes) exceeds 8 and is not one of the valid HAM values 6 (HAM6) or 8 (HAM8); the pre-patch check in src/IMG_lbm.c failed to validate bitplane count when flagHAM was set, so 1<<nbplanes overruns the 256-entry colormap stack array. Exploitation is LIMITED by: mandatory user/application interaction to process the file (UI:P), a local delivery vector (AV:L, the file must reach and be opened by the target), and the fact that only software actually invoking the ILBM loader on untrusted input is exposed - the legacy Amiga ILBM/HAM format is uncommon in typical workflows. No authentication is required (PR:N). |
| Impact | This is a medium-severity (CVSS 4.0 base 6.9) out-of-bounds READ (CWE-125), not a memory-corruption/write primitive, so the realistic worst case is a crash (VA:H / DoS) plus limited disclosure of adjacent stack memory (VC:L) - not code execution. The vendor's 4.0 vector is AV:L/AC:L/AT:N/PR:N/UI:P, meaning no privileges are required but a user or application must process the attacker-supplied file locally; there is no network-exploitable, no-interaction path. Decision signals are muted: not in CISA KEV, no EPSS score was supplied, and the vuln.today priority is 'this_month' (a routine patch cadence, not act_now/emergency). No POC/Exploit was flagged as confirmed in the input, so this is driven by a VulnCheck advisory and vendor commits rather than observed exploitation. The signals are internally consistent - a moderate-impact, interaction-gated, local-file parsing bug - and the main residual risk is to applications that load untrusted ILBM/LBM images via SDL_image; the legacy Amiga ILBM/HAM format further narrows the real attack surface. EPSS and any observed-exploitation data are MISSING; treat prioritization as 'patch in normal cycle' per the supplied decision label. |
| Exploit ScenarioDerived | An attacker crafts a malicious ILBM file with the HAM flag set and more than 8 bitplanes (a count other than the valid HAM6/HAM8 values of 6 or 8) and gets a victim application built on SDL_image to open it. When IMG_LoadLBM_IO() parses the file it skips the bitplane-count validation for HAM mode and reads past the 256-entry colormap stack array, crashing the process or disclosing adjacent stack memory. No public exploit was identified in the input, and exploitation requires the application to process the file (UI:P, local vector). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A stack out-of-bounds read in SDL_image's ILBM/LBM loader (IMG_LoadLBM_IO in src/IMG_lbm.c) lets a crafted image with the HAM flag set and more than 8 bitplanes drive the palette loop past the 256-entry colormap stack array, crashing the host application and potentially leaking adjacent stack memory. Both branches are affected: 3.0.0 through 3.4.8 and 0 through 2.8.12. The impact is a read primitive only, so the realistic worst case is denial of service plus limited information disclosure rather than code execution; exploitation requires an application using the library to open the attacker-supplied file (UI:P, AV:L, PR:N - unauthenticated), and no public exploit was identified at time of analysis. Vendor fixes are published as upstream commits 5cfbe85f3a783417eec4d5aa0660b40c2cff5292 and 9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996, which add explicit HAM bitplane validation.
RemediationAI
Apply the upstream fixes from the SDL_image repository: commit 5cfbe85f3a783417eec4d5aa0660b40c2cff5292 for the 3.x branch (it patches the release-3.4.8 tree of src/IMG_lbm.c) and commit 9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996 for the 2.x branch, which replace the HAM flag exemption with the explicit validHAM test accepting only 6 or 8 bitplanes; the vendor records a patch as available, but an independently confirmed tagged release version is not established from the supplied data, so verify against the repository and your distribution's packaging before assuming a shipped release is fixed. Track upstream at https://github.com/libsdl-org/SDL_image and the issue at https://github.com/libsdl-org/SDL_image/issues/769, and see https://www.vulncheck.com/advisories/sdl-image-through-3.4.8-and-2.8.12-stack-out-of-bounds-read-in-ilbm-loader. Where rebuilding or upgrading is not yet possible, the exposure is bounded by the trigger conditions: only inputs that set the CAMG HAM flag together with a bitplane count above 8 (and not 6 or 8) reach the faulty path, so restricting SDL_image consumers to trusted image sources, or rejecting/blocking ILBM and LBM content at ingestion points before it reaches the library, removes the attack surface - with the trade-off that legitimate Amiga ILBM/HAM artwork and any workflow depending on it will no longer load. Because the vector is local and requires the file to be opened by the target application, reducing which users and services can hand files to SDL_image-based viewers or converters also limits exposure; neither workaround repairs the underlying out-of-bounds read, which requires the code fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ILBM (Interleaved Bitmap) is the legacy Amiga image format that SDL_image parses in src/IMG_lbm.c; its HAM (Hold-And-Modify) modes, signalled by the CAMG chunk flag, are restricted to HAM6 (6 bitplanes) and HAM8 (8 bitplanes). The vulnerable code path in IMG_LoadLBM_IO computes 1<<nbplanes to size the palette/colormap handling against a fixed 256-entry stack array, and the pre-patch guard only rejected oversized bitplane counts when the HAM flag was clear (if (!pbm && nbplanes > 8 && nbplanes != 24 && flagHAM 0)). Because the check was bypassed whenever flagHAM was set, a file declaring a HAM mode with more than 8 bitplanes indexes beyond the stack colormap. The published fix replaces the flag-based exemption with an explicit validity test, const bool validHAM = (flagHAM && (nbplanes 6 || nbplanes == 8));, and applies the size check whenever that test fails. This is CWE-125 (out-of-bounds read): the operations are reads of stack memory, so the observable effects are an out-of-bounds access that can terminate the process (availability impact assessed as high) and can return stack contents into image data or error paths (confidentiality impact assessed as low). No write primitive is described in the available sources. The CPE cpe:2.3:a:libsdl-org:sdl_image:*:*:*:*:*:*:*:* does not constrain versions, so version scoping must come from the EUVD ranges.
Know when Sdl Image gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
A victim app must open a local crafted file (AV:L/UI:R, PR:N); the out-of-bounds read leaks limited stack memory (C:L) and crashes the process (A:H) with no integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. Rated h
An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer
An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL
An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedi
An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. Rated
Heap out-of-bounds read in SDL_image library's XCF format parser allows remote information disclosure when processing ma
Exploit-DB