CVE-2026-117557— SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader

Quick assessment

Affected

libsdl-org SDL_image

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SDL_image 在 3.4.8 及更早版本、以及 2.8.12 及更早版本中，存在一个栈越界读取漏洞。该漏洞位于文件中的函数：当启用 HAM（Hold-And-Modify）模式时，该函数会跳过对位平面（bitplane）数量的验证。攻击者可构造一个包含超过 8 个 HAM 位平面的 ILBM 文件，从而读取调色板栈数组之外的内存，导致程序崩溃或泄露栈内存数据。

CVSS 6.1 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1552 · Unsecured Credentials T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader

Source: CVE Program / CVE List V5

Vulnerability Description

SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
libsdl-org	SDL_image	0 ~ 2.8.12	-

II. Public POCs for CVE-2026-117557

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117557

请登录查看更多情报信息。

Other References for CVE-2026-117557 (6)

https://github.com/libsdl-org/SDL_image/commit/5cfbe85f3a783417eec4d5aa0660b40c2cff5292 patch
https://github.com/libsdl-org/SDL_image/commit/9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996 patch
https://github.com/libsdl-org/SDL_image/blob/release-3.4.8/src/IMG_lbm.c#L240 technical-description
https://github.com/libsdl-org/SDL_image product
https://github.com/libsdl-org/SDL_image/issues/769 issue-tracking
https://www.vulncheck.com/advisories/sdl-image-through-3.4.8-and-2.8.12-stack-out-of-bounds-read-in-ilbm-loader third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-117557

IV. Related Vulnerabilities

Same product: SDL_image

CVE-2026-35444
SDL_image has a heap buffer overflow READ via unchecked colo

Same vendor: libsdl-org

CVE-2026-35444
SDL_image has a heap buffer overflow READ via unchecked colo

Same weakness: CWE-125