CVE-2026-35444: 
NixOS vulnerability analysis and mitigation

CVE-2026-35444 is a heap out-of-bounds read vulnerability in SDL_image's XCF image loader that can expose sensitive heap memory contents via crafted image files. The flaw exists in the do_layer_surface() function in src/IMG_xcf.c, where pixel index values from decoded XCF tile data are used directly as colormap indices without bounds validation. It affects all versions of SDL_image prior to commit 996bf12888925932daace576e09c3053410896f8 (patched April 2, 2026). The vulnerability was disclosed on April 6, 2026, and carries a CVSS v3.1 base score of 7.1 (High) per the GitHub Security Advisory, or 6.1 (Medium) per NVD scoring (GitHub Advisory).

The root cause is an out-of-bounds read (CWE-125) in the XCF image parsing code within do_layer_surface() in src/IMG_xcf.c. When processing IMAGE_INDEXED tiles (both bpp=1 and bpp=2 code paths), pixel index values decoded from XCF tile data are used directly as indices into the colormap array without being validated against the colormap size (cm_num). A specially crafted .xcf file with a small colormap and deliberately out-of-range pixel indices can trigger heap reads of up to 762 bytes beyond the colormap allocation boundary. The leaked heap bytes are then written into the output surface pixel data, making them potentially observable in the rendered image output. The vulnerability has been ASAN-confirmed on both x86_64 and aarch64 architectures, and was discovered by researcher Sebastián Alba Vives (@Sebasteuo) (GitHub Advisory).

Successful exploitation results in information disclosure, as up to 762 bytes of heap memory adjacent to the colormap allocation can be leaked and embedded into the rendered image output, potentially exposing sensitive data such as heap metadata, cryptographic material, or other in-memory content. The vulnerability also carries a low availability impact, as the out-of-bounds read could contribute to instability in the image processing pipeline. Exploitation requires user interaction — specifically, a user or application must open or process a maliciously crafted .xcf file — limiting the attack surface to scenarios where untrusted image files are processed (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. Exploitation requires user interaction (opening a crafted .xcf file) and local access context per NVD scoring, further reducing practical risk.

1. Craft a malicious XCF file: Create a .xcf file with a minimal colormap (e.g., cm_num set to a small value such as 1 or 2 entries) and populate the IMAGE_INDEXED tile data with pixel index values that exceed the colormap size, targeting out-of-range heap offsets of up to 762 bytes.
2. Deliver the file to the target: Use social engineering, a malicious download link, or embed the crafted .xcf file in a context where the target application automatically processes it (e.g., a file manager with thumbnail generation, an image viewer, or a game using SDL_image).
3. Trigger image loading: Cause the vulnerable application to load the crafted .xcf file via SDL_image's IMG_Load() or equivalent API, invoking do_layer_surface() in src/IMG_xcf.c.
4. Observe leaked heap data: The out-of-bounds heap bytes are written into the output SDL surface pixel buffer. If the rendered image is transmitted back to the attacker (e.g., via a thumbnail preview service or screenshot), the attacker can extract and analyze the pixel data to recover leaked heap memory contents (GitHub Advisory).

• File System: Presence of unexpected or unsolicited .xcf files in user download directories, temporary folders, or application asset directories; files with anomalously small colormap sections relative to their pixel data.
• Logs: Application crash logs or ASAN/sanitizer output referencing heap-buffer-overflow reads in IMG_xcf.c or do_layer_surface(); error messages from SDL_image related to XCF parsing failures.
• Process: Unexpected image processing activity (e.g., thumbnail generation processes) consuming abnormal memory or crashing when processing .xcf files from untrusted sources.
• Network: Inbound delivery of .xcf files via email attachments, web downloads, or file-sharing services from unknown or suspicious sources, particularly in environments not typically handling XCF (GIMP native) format files.

Update SDL_image to a version incorporating commit 996bf12888925932daace576e09c3053410896f8 or later (released April 2, 2026), which adds proper bounds validation of pixel index values against the colormap size before use. Fedora, openSUSE, and other Linux distributions have issued updated packages for both SDL2_image and SDL3_image addressing this vulnerability. As a workaround, restrict or disable processing of .xcf image files from untrusted sources within applications that depend on SDL_image, and implement file type validation to block XCF files where not required (GitHub Advisory).

The vulnerability received standard distribution-level attention, with openSUSE and Fedora issuing security update announcements for their SDL_image packages shortly after disclosure. The Yocto Project security mailing list also tracked the CVE across multiple messages. Coverage was largely routine, with no notable researcher commentary or significant social media discussion beyond automated vulnerability tracking posts.