SDL_image’s XCF loader uses pixel index values directly as colormap indices without checking them against the actual colormap size. A crafted .xcf file can contain pixel indices that exceed the colormap bounds, causing SDL_image to read up to 762 bytes beyond the allocated colormap area. The leaked bytes are copied into the output image’s pixel data, making sensitive information potentially visible in the rendered image. This vulnerability is a classic unchecked read, classified as CWE‑125.

The flaw exists in the SDL_image library distributed by libsdl-org. Any release that contains the buggy XCF loader and has not been updated to commit 996bf12888925932daace576e09c3053410896f8 is affected. Systems that use this library to load XCF images from untrusted sources are at risk.

The CVSS score of 7.1 indicates a moderate to high impact severity. While no EPSS data is available and the vulnerability is not in CISA’s KEV catalog, the exploit requires a malicious .xcf file to be processed by an application using SDL_image. Thus the attack vector is local with an untrusted file. A successful exploitation can leak memory contents to an attacker through the visible image, resulting in confidentiality compromise. The risk is significant enough to warrant an immediate patch.