CVE catalog

CVE-2026-35444

SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices wi

[CVE catalog]

Severity
High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.26% · Oct 25, 2026

SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansdl-image1.2sid1.2.12-14vulnerable
Debiansdl-image1.2forky1.2.12-14vulnerable
Debiansdl-image1.2trixie1.2.12-14vulnerable
Debiansdl-image1.2bookworm1.2.12-13vulnerable
Debianlibsdl2-imagesid2.8.12+dfsg-2fixed
Debianlibsdl2-imageforky2.8.12+dfsg-2fixed
Debianlibsdl2-imagetrixie2.8.8+dfsg-1+deb13u1fixed
Debianlibsdl2-imagebookworm2.6.3+dfsg-1vulnerable
Cpelibsdl2-imageNot reportedNot reportedvulnerable
Cpesdl-image1.2Not reportedNot reportedvulnerable
Cpesdl_imageNot reported2026-04-02fixed
OpensuseSDL2_imagetumbleweed2.8.10-1.1fixed
OpensuseSDL3_imagetumbleweed3.4.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansdl-image1.2sourcesid(unfixed)not yet assignedNot reported[1133012]
Debiansdl-image1.2sourceforky(unfixed)not yet assignedNot reported[1133012]
Debiansdl-image1.2sourcetrixie(unfixed)not yet assignedNot reported[1133012]
Debiansdl-image1.2sourcebookworm(unfixed)not yet assignedNot reported[1133012]
Debianlibsdl2-imagesourcesid2.8.10+dfsg-1not yet assignedNot reported[1133010]
Debianlibsdl2-imagesourceforky2.8.10+dfsg-1not yet assignedNot reported[1133010]
Debianlibsdl2-imagesourcetrixie2.8.8+dfsg-1+deb13u1not yet assignedNot reported[1133010]
Debianlibsdl2-imagesourcebookworm(unfixed)not yet assignedNot reported[1133010]
Cpesdl_imagecpeNot reported2026-04-02Not reportedNot reportedNot reported
OpensuseSDL2_imagerpmtumbleweed2.8.10-1.1Not reportedOPENSUSE-SU-2026:10494-1Not reported
OpensuseSDL3_imagerpmtumbleweed3.4.2-1.1Not reportedOPENSUSE-SU-2026:10493-1Not reported

[Debian bug #1133012][Debian bug #1133010]

Notes

[trixie] sdl-image1.2: Minor issue [bookworm] sdl-image1.2: Minor issue [bookworm] libsdl2-image: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libsdl2-image-2.0-0]Affected

    Source package: [libsdl2-image]

    Details (2)

    • 2.6.3+dfsg-1 · amd64 · bookworm

      Affected

      nvd · libsdl2-image · debian · bookworm; nvd · libsdl2-image · debian · 12

    • 2.6.3+dfsg-1 · arm64 · bookworm

      Affected

      nvd · libsdl2-image · debian · bookworm; nvd · libsdl2-image · debian · 12

  • [libsdl2-image-dev]Affected

    Source package: [libsdl2-image]

    Details (2)

    • 2.6.3+dfsg-1 · amd64 · bookworm

      Affected

      nvd · libsdl2-image · debian · bookworm; nvd · libsdl2-image · debian · 12

    • 2.6.3+dfsg-1 · arm64 · bookworm

      Affected

      nvd · libsdl2-image · debian · bookworm; nvd · libsdl2-image · debian · 12

  • [libsdl2-image-tests]Affected

    Source package: [libsdl2-image]

    Details (2)

    • 2.6.3+dfsg-1 · amd64 · bookworm

      Affected

      nvd · libsdl2-image · debian · bookworm; nvd · libsdl2-image · debian · 12

    • 2.6.3+dfsg-1 · arm64 · bookworm

      Affected

      nvd · libsdl2-image · debian · bookworm; nvd · libsdl2-image · debian · 12

  • [libsdl-image1.2]Affected

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-13+b2 · amd64 · bookworm

      Affected

      nvd · sdl-image1.2 · debian · bookworm; nvd · sdl-image1.2 · debian · 12

    • 1.2.12-13+b2 · arm64 · bookworm

      Affected

      nvd · sdl-image1.2 · debian · bookworm; nvd · sdl-image1.2 · debian · 12

  • [libsdl-image1.2-dev]Affected

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-13+b2 · amd64 · bookworm

      Affected

      nvd · sdl-image1.2 · debian · bookworm; nvd · sdl-image1.2 · debian · 12

    • 1.2.12-13+b2 · arm64 · bookworm

      Affected

      nvd · sdl-image1.2 · debian · bookworm; nvd · sdl-image1.2 · debian · 12

[Debian 13 (Trixie)]

  • [libsdl2-image-2.0-0]Affected

    Source package: [libsdl2-image]

    Details (2)

    • 2.8.8+dfsg-1 · amd64 · trixie

      Affected · Fixed: 2.8.8+dfsg-1+deb13u1

      nvd · libsdl2-image · debian · 13

    • 2.8.8+dfsg-1 · arm64 · trixie

      Affected · Fixed: 2.8.8+dfsg-1+deb13u1

      nvd · libsdl2-image · debian · 13

  • [libsdl2-image-dev]Affected

    Source package: [libsdl2-image]

    Details (2)

    • 2.8.8+dfsg-1 · amd64 · trixie

      Affected · Fixed: 2.8.8+dfsg-1+deb13u1

      nvd · libsdl2-image · debian · 13

    • 2.8.8+dfsg-1 · arm64 · trixie

      Affected · Fixed: 2.8.8+dfsg-1+deb13u1

      nvd · libsdl2-image · debian · 13

  • [libsdl2-image-tests]Affected

    Source package: [libsdl2-image]

    Details (2)

    • 2.8.8+dfsg-1 · amd64 · trixie

      Affected · Fixed: 2.8.8+dfsg-1+deb13u1

      nvd · libsdl2-image · debian · 13

    • 2.8.8+dfsg-1 · arm64 · trixie

      Affected · Fixed: 2.8.8+dfsg-1+deb13u1

      nvd · libsdl2-image · debian · 13

  • [libsdl3-image0]Affected

    Source package: [libsdl3-image]

    Details (2)

    • 3.2.4+ds-1 · amd64 · trixie

      Affected · Fixed: 3.2.4+ds-1+deb13u1

      nvd · libsdl3-image · debian · 13

    • 3.2.4+ds-1 · arm64 · trixie

      Affected · Fixed: 3.2.4+ds-1+deb13u1

      nvd · libsdl3-image · debian · 13

  • [libsdl3-image-dev]Affected

    Source package: [libsdl3-image]

    Details (2)

    • 3.2.4+ds-1 · amd64 · trixie

      Affected · Fixed: 3.2.4+ds-1+deb13u1

      nvd · libsdl3-image · debian · 13

    • 3.2.4+ds-1 · arm64 · trixie

      Affected · Fixed: 3.2.4+ds-1+deb13u1

      nvd · libsdl3-image · debian · 13

  • [libsdl3-image-doc]Affected

    Source package: [libsdl3-image]

    Details (2)

    • 3.2.4+ds-1 · all · trixie

      Affected · Fixed: 3.2.4+ds-1+deb13u1

      nvd · libsdl3-image · debian · 13

    • 3.2.4+ds-1 · all · trixie

      Affected · Fixed: 3.2.4+ds-1+deb13u1

      nvd · libsdl3-image · debian · 13

  • [libsdl3-image-tests]Affected

    Source package: [libsdl3-image]

    Details (2)

    • 3.2.4+ds-1 · amd64 · trixie

      Affected · Fixed: 3.2.4+ds-1+deb13u1

      nvd · libsdl3-image · debian · 13

    • 3.2.4+ds-1 · arm64 · trixie

      Affected · Fixed: 3.2.4+ds-1+deb13u1

      nvd · libsdl3-image · debian · 13

  • [libsdl-image1.2]Affected

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-14 · amd64 · trixie

      Affected

      nvd · sdl-image1.2 · debian · 13

    • 1.2.12-14 · arm64 · trixie

      Affected

      nvd · sdl-image1.2 · debian · 13

  • [libsdl-image1.2-dev]Affected

    Source package: [sdl-image1.2]

    Details (2)

    • 1.2.12-14 · amd64 · trixie

      Affected

      nvd · sdl-image1.2 · debian · 13

    • 1.2.12-14 · arm64 · trixie

      Affected

      nvd · sdl-image1.2 · debian · 13

[openSUSE Tumbleweed]

  • [libSDL2_image-2_0-0]Unknown

    Source package: [SDL2_image]

    Details (1)

    • 2.8.12-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.8.10-1.1

      Version impact unknown

      nvd · SDL2_image · opensuse · tumbleweed

  • [libSDL2_image-2_0-0-32bit]Unknown

    Source package: [SDL2_image]

    Details (1)

    • 2.8.12-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.8.10-1.1

      Version impact unknown

      nvd · SDL2_image · opensuse · tumbleweed

  • [libSDL3_image0]Unknown

    Source package: [SDL3_image]

    Details (1)

    • 3.4.4-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 3.4.2-1.1

      Version impact unknown

      nvd · SDL3_image · opensuse · tumbleweed

  • [SDL2_image-devel]Unknown

    Source package: [SDL2_image]

    Details (1)

    • 2.8.12-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.8.10-1.1

      Version impact unknown

      nvd · SDL2_image · opensuse · tumbleweed

  • [SDL3_image-devel]Unknown

    Source package: [SDL3_image]

    Details (1)

    • 3.4.4-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 3.4.2-1.1

      Version impact unknown

      nvd · SDL3_image · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]