SDL_image's do_layer_surface() function in src/IMG_xcf.c uses pixel index values from decoded XCF tile data directly as colormap indices without validating them against the colormap size (cm_num). This leads to heap out-of-bounds reads of up to 762 bytes past the colormap allocation when processing crafted .xcf files with small colormaps and out-of-range pixel indices. Both 1-bit and 2-bit per pixel indexed image code paths are affected. The leaked heap bytes are incorporated into the output surface pixel data, potentially exposing memory contents in the rendered image. The vulnerability is fixed in commit 996bf12888925932daace576e09c3053410896f8.

An attacker can craft a malicious .xcf image file that triggers heap out-of-bounds reads during image loading, causing memory beyond the colormap to be read and included in the rendered image surface. This can lead to information disclosure of heap memory contents. There is no indication of code execution or integrity impact. The vulnerability requires user interaction (loading a crafted image) and network attack vector is possible if image files are processed from untrusted sources.

A fix for this vulnerability is available in SDL_image at commit 996bf12888925932daace576e09c3053410896f8. Users and developers should update to this fixed version or later to remediate the issue. Since this is a library vulnerability, ensure that any software using SDL_image is rebuilt or updated accordingly. Patch status is confirmed by the vendor commit fixing the issue.