CVE-2026-117557

Name of the Vulnerable Software and Affected Versions SDL image versions prior to 3.4.9 SDL image versions prior to 2.8.13

Description A stack out-of-bounds read exists in the IMG LoadLBM IO() function within src/IMG lbm.c. The issue occurs when HAM mode is enabled, as the software fails to validate the bitplane count. An attacker can provide a specially crafted ILBM file containing more than 8 HAM bitplanes to read beyond the colormap stack array, which may lead to application crashes or the disclosure of stack memory.

Recommendations Update to version 3.4.9 or later. Update to version 2.8.13 or later.