SDL_image vulnerabilities

SDL_image 2.0.1 has a buffer overflow vulnerability in the XCF property handling functionality. A specially crafted xcf file can cause a stack-based buffer overflow, potentially leading to code execution.

SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is set. A crafted ILBM file with more than 8 HAM bitplanes causes reads past the colormap stack array.

The SDL_image library before commit 996bf12888925932daace576e09c3053410896f8 has a heap out-of-bounds read vulnerability in do_layer_surface() in src/IMG_xcf.c. Pixel indices from XCF files are used without validation against colormap size, allowing reads up to 762 bytes past the allocation, with leaked data potentially visible in the rendered image.