{"id":"CVE-2026-35444","aliases":["DEBIAN-CVE-2026-35444","EUVD-2026-19527","GHSA-gq8w-x74c-h6p7","UBUNTU-CVE-2026-35444","openSUSE-SU-2026:10493-1","openSUSE-SU-2026:10494-1"],"status":"published","title":"SDL_image has a heap buffer overflow READ via unchecked colormap index in XCF loader","description":"SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00266,"percentile":0.18723,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-04-05T00:00:00Z","modified":"2026-10-28T10:55:06Z","fixes":[{"ecosystem":"Debian:13","package":"libsdl2-image","fixed_in":["2.8.8+dfsg-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsdl2-image","fixed_in":["2.8.10+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsdl3-image","fixed_in":["3.2.4+ds-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsdl3-image","fixed_in":["3.4.2+ds-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"SDL3_image","fixed_in":["3.4.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"SDL2_image","fixed_in":["2.8.10-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3+dfsg-1","2.6.3+dfsg-2","2.8.0+dfsg-1","2.8.1+dfsg-1","2.8.10+dfsg-1","2.8.12+dfsg-1","2.8.12+dfsg-2","2.8.2+dfsg-1","2.8.4+dfsg-1","2.8.5+dfsg-1","2.8.6+dfsg-1","2.8.6+dfsg-2","2.8.8+dfsg-1","2.8.8+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.8+dfsg-1+deb13u1"}]}],"versions":["2.8.8+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.10+dfsg-1"}]}],"versions":["2.8.8+dfsg-1","2.8.8+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libsdl3-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4+ds-1+deb13u1"}]}],"versions":["3.2.4+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libsdl3-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2+ds-1"}]}],"versions":["3.2.4+ds-1","3.2.6+ds-1","3.3.4+ds-1","3.3.4+ds-2","3.4.0+ds-1"]},{"source":"osv","ecosystem":"Debian:12","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-13","1.2.12-14"]},{"source":"osv","ecosystem":"Debian:13","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-14"]},{"source":"osv","ecosystem":"Debian:14","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0+dfsg-2","2.0.0+dfsg-3","2.0.0+dfsg-3build2","2.0.0+dfsg-3+deb8u1build0.14.04.1","2.0.0+dfsg-3+deb8u2build0.14.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-4ubuntu1","1.2.12-5","1.2.12-5build2","1.2.12-5+deb9u1build0.14.04.1","1.2.12-5+deb9u1ubuntu0.14.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0+dfsg-3build2","2.0.1+dfsg-1","2.0.1+dfsg-2","2.0.1+dfsg-2+deb9u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-5build2","1.2.12-5+deb9u1build0.16.04.1","1.2.12-5+deb9u1ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+dfsg-3","2.0.1+dfsg-4","2.0.2+dfsg1-1","2.0.3+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-6","1.2.12-7","1.2.12-8","1.2.12-8ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5+dfsg1-1","2.0.5+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-12"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5+dfsg1-2","2.0.5+dfsg1-3","2.0.5+dfsg1-3build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-12","1.2.12-13","1.2.12-13build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3+dfsg-2","2.8.0+dfsg-1","2.8.1+dfsg-1","2.8.2+dfsg-1","2.8.2+dfsg-1build1","2.8.2+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-13build2","1.2.12-13build3","1.2.12-13build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.8+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libsdl3-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.4+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-14"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.8+dfsg-2","2.8.12+dfsg-1","2.8.12+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsdl3-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0+ds-1","3.4.4+ds-1","3.4.4+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-14build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsdl2-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.8+dfsg-1","2.8.8+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsdl3-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.4+ds-1","3.4.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"sdl-image1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.12-14","1.2.12-14build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"SDL3_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"SDL2_image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.10-1.1"}]}]}],"products":[{"vendor":"libsdl","product":"sdl_image"},{"vendor":"libsdl-org","product":"sdl_image"}],"references":[{"url":"https://github.com/libsdl-org/SDL_image/security/advisories/GHSA-gq8w-x74c-h6p7","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35444.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35444","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-35444","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-35444","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35444","tags":["report"]},{"url":"https://github.com/libsdl-org/SDL_image/commit/996bf12888925932daace576e09c3053410896f8","tags":["report"]},{"url":"https://github.com/libsdl-org/SDL_image/commit/a1a06276a51ca7e6e63908b200df8a278d8c5039","tags":["report"]},{"url":"https://github.com/libsdl-org/SDL_image/commit/678ac6a4c6021853485050926f45db08ba6aec48","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35444","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-35444","title":"SDL_image has a heap buffer overflow READ via unchecked colormap index in XCF loader","description":"SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.","status":"published","published":"2026-04-06T21:44:05.986Z","modified":"2026-04-08T14:06:28.528Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:20:05.505362Z"}],"euvd":[{"id":"EUVD-2026-19527","description":"SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.","status":"published","published":"2026-04-06T21:44:05Z","modified":"2026-04-08T14:06:28Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T19:25:12.037386Z"}],"nvd":[{"id":"CVE-2026-35444","description":"SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.","status":"published","published":"2026-04-06T22:16:23.003Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:13.1424Z"}],"osv":[{"id":"CVE-2026-35444","title":"SDL_image has a heap buffer overflow READ via unchecked colormap index in XCF loader","description":"SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.","status":"published","published":"2026-04-06T21:44:05.986Z","modified":"2026-10-28T10:55:06.087622741Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:02.673625Z"},{"id":"DEBIAN-CVE-2026-35444","description":"SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.","status":"published","published":"2026-04-06T22:16:23.003Z","modified":"2026-10-01T03:03:12.657088189Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"UBUNTU-CVE-2026-35444","description":"SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.","status":"published","published":"2026-04-06T22:16:00Z","modified":"2026-10-17T13:00:03.186697597Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"openSUSE-SU-2026:10493-1","title":"SDL3_image-devel-3.4.2-1.1 on GA media","description":"These are all security issues fixed in the SDL3_image-devel-3.4.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-05T00:00:00Z","modified":"2026-04-06T07:15:07.188605Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10494-1","title":"SDL2_image-devel-2.8.10-1.1 on GA media","description":"These are all security issues fixed in the SDL2_image-devel-2.8.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-07T00:00:00Z","modified":"2026-04-08T07:50:15.59519Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}