Sdl Image
Monthly
A stack out-of-bounds read in SDL_image's ILBM/LBM loader (IMG_LoadLBM_IO in src/IMG_lbm.c) lets a crafted image with the HAM flag set and more than 8 bitplanes drive the palette loop past the 256-entry colormap stack array, crashing the host application and potentially leaking adjacent stack memory. Both branches are affected: 3.0.0 through 3.4.8 and 0 through 2.8.12. The impact is a read primitive only, so the realistic worst case is denial of service plus limited information disclosure rather than code execution; exploitation requires an application using the library to open the attacker-supplied file (UI:P, AV:L, PR:N - unauthenticated), and no public exploit was identified at time of analysis. Vendor fixes are published as upstream commits 5cfbe85f3a783417eec4d5aa0660b40c2cff5292 and 9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996, which add explicit HAM bitplane validation.
Heap out-of-bounds read in SDL_image library's XCF format parser allows remote information disclosure when processing malicious GIMP files. Attackers can craft .xcf files with undersized colormaps and invalid pixel indices to leak up to 762 bytes of heap memory into rendered image data, potentially exposing sensitive process memory. The vulnerability affects both indexed color code paths (1-bit and 2-bit per pixel). No public exploit identified at time of analysis, but EPSS and exploitation likelihood are notable given the library's widespread use in gaming and multimedia applications requiring minimal user interaction (opening a file).
An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stack out-of-bounds read in SDL_image's ILBM/LBM loader (IMG_LoadLBM_IO in src/IMG_lbm.c) lets a crafted image with the HAM flag set and more than 8 bitplanes drive the palette loop past the 256-entry colormap stack array, crashing the host application and potentially leaking adjacent stack memory. Both branches are affected: 3.0.0 through 3.4.8 and 0 through 2.8.12. The impact is a read primitive only, so the realistic worst case is denial of service plus limited information disclosure rather than code execution; exploitation requires an application using the library to open the attacker-supplied file (UI:P, AV:L, PR:N - unauthenticated), and no public exploit was identified at time of analysis. Vendor fixes are published as upstream commits 5cfbe85f3a783417eec4d5aa0660b40c2cff5292 and 9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996, which add explicit HAM bitplane validation.
Heap out-of-bounds read in SDL_image library's XCF format parser allows remote information disclosure when processing malicious GIMP files. Attackers can craft .xcf files with undersized colormaps and invalid pixel indices to leak up to 762 bytes of heap memory into rendered image data, potentially exposing sensitive process memory. The vulnerability affects both indexed color code paths (1-bit and 2-bit per pixel). No public exploit identified at time of analysis, but EPSS and exploitation likelihood are notable given the library's widespread use in gaming and multimedia applications requiring minimal user interaction (opening a file).
An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.