{"id":"CVE-2026-117557","title":"SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader","summary":"SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with mo…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cvssSource":"cna","cwe":["CWE-125"],"vendor":"libsdl-org","product":"SDL_image","affected":["SDL_image <= 2.8.12","SDL_image >= 3.0.0 <= 3.4.8"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T13:07:52.419Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117557","references":[{"url":"https://github.com/libsdl-org/SDL_image/issues/769","label":"GitHub Issue #769"},{"url":"https://github.com/libsdl-org/SDL_image"},{"url":"https://github.com/libsdl-org/SDL_image/commit/5cfbe85f3a783417eec4d5aa0660b40c2cff5292"},{"url":"https://github.com/libsdl-org/SDL_image/commit/9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996"},{"url":"https://github.com/libsdl-org/SDL_image/blob/release-3.4.8/src/IMG_lbm.c#L240"},{"url":"https://www.vulncheck.com/advisories/sdl-image-through-3.4.8-and-2.8.12-stack-out-of-bounds-read-in-ilbm-loader","label":"VulnCheck Advisory: SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T16:11:59.334Z","slug":"CVE-2026-117557","body":"## Overview\n\nSDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.\n\n## Affected\n\n- `SDL_image <= 2.8.12`\n- `SDL_image >= 3.0.0 <= 3.4.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}