CVE-2026-35444

CVE-2026-35444 is a heap out-of-bounds read vulnerability in SDL_image's XCF image file parser. The flaw exists in the do_layer_surface() function within src/IMG_xcf.c, where pixel index values are used directly as colormap indices without proper validation. This affects both indexed color code paths (bpp=1 and bpp=2) and allows reading up to 762 bytes beyond the colormap allocation, with potential disclosure of heap memory contents through the rendered image output. The vulnerability carries a CVSS 3.1 score of 6.1 MEDIUM with a local attack vector, low complexity, and no special privileges required. Exploitation requires user interaction to open a maliciously crafted XCF file. While the confidentiality impact is rated high due to heap memory disclosure potential, integrity is not affected and availability impact is limited. The EPSS score of 0.0001 indicates minimal exploitation probability in the wild relative to other vulnerabilities. There is no evidence of active exploitation in the wild. The CVE is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. However, a fix has been implemented with commit 996bf12888925932daace576e09c3053410896f8, and organizations using SDL_image should update to patched versions to mitigate information disclosure risks.