---
id: CVE-2026-117557
title: SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader
summary: >-
  SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read
  vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count
  validation when HAM mode is set. Attackers can supply a crafted ILBM file with
  mo…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: libsdl-org
product: SDL_image
affected:
  - SDL_image <= 2.8.12
  - SDL_image >= 3.0.0 <= 3.4.8
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T13:07:52.419Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117557'
references:
  - url: 'https://github.com/libsdl-org/SDL_image/issues/769'
    label: 'GitHub Issue #769'
  - url: 'https://github.com/libsdl-org/SDL_image'
  - url: >-
      https://github.com/libsdl-org/SDL_image/commit/5cfbe85f3a783417eec4d5aa0660b40c2cff5292
  - url: >-
      https://github.com/libsdl-org/SDL_image/commit/9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996
  - url: >-
      https://github.com/libsdl-org/SDL_image/blob/release-3.4.8/src/IMG_lbm.c#L240
  - url: >-
      https://www.vulncheck.com/advisories/sdl-image-through-3.4.8-and-2.8.12-stack-out-of-bounds-read-in-ilbm-loader
    label: >-
      VulnCheck Advisory: SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds
      Read in ILBM Loader
tags:
  - cve.org
ingestedAt: '2026-10-27T16:11:59.334Z'
---

## Overview

SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array, causing crashes or disclosing stack memory.

## Affected

- `SDL_image <= 2.8.12`
- `SDL_image >= 3.0.0 <= 3.4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.