Executive brief
SDL_image is a widely used library that allows applications to load and display various image file formats. A security flaw in how it handles GIMP (XCF) image files could allow an attacker to trick a user into opening a specially crafted file, resulting in the exposure of sensitive information from the computer's memory. This leaked data might be visible within the rendered image itself, potentially compromising user privacy or system security.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the XCF image loader of SDL_image within the do_layer_surface() function in src/IMG_xcf.c. The root cause is a failure to validate pixel index values from decoded XCF tile data against the colormap size (cm_num) before using them as indices. An attacker can exploit this by providing a crafted .xcf file with a small colormap and out-of-range indices, triggering a heap out-of-bounds read of up to 762 bytes. This affects both IMAGE_INDEXED code paths (bpp=1 and bpp=2). The leaked memory content is subsequently written into the output surface pixel data, allowing for potential information disclosure via the rendered image. The issue is resolved in commit 996bf12888925932daace576e09c3053410896f8.
Affected products
- libsdl-org SDL_image All versions prior to commit 996bf12888925932daace576e09c3053410896f8
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-06: disclosed: NVD publication date