SDL_image up to versions 3.4.8 and 2.8.12 has a stack out‑of‑bounds read flaw in the ILBM loader that neglects to validate the HAM bitplane count when HAM mode is enabled. A crafted ILBM file containing more than eight HAM bitplanes can cause the loader to read past the colormap stack array, which may crash the application or expose sensitive stack contents to an attacker. Consequently, the vulnerability supports information disclosure and can lead to denial of service.

The flaw affects the SDL_image library distributed by libsdl-org. Specifically, any installation of SDL_image 3.x versions up to and including 3.4.8, and SDL_image 2.x versions up to and including 2.8.12, is vulnerable. Applications that embed these versions and process ILBM files are potentially impacted.

The vulnerability is rated with a CVSS score of 6.9, indicating a moderate severity level. The EPSS score is unavailable, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is local or remote code that supplies a malicious ILBM image file to an application using the affected SDL_image library; this may result in a crash or the disclosure of stack data. The presence of the EPSS as not available does not diminish the potential impact if an attacker can supply the crafted input.