SDL_image's do_layer_surface() function in src/IMG_xcf.c uses pixel index values from decoded XCF tile data directly as colormap indices without validating them against the colormap size (cm_num). This leads to heap out-of-bounds reads of up to 762 bytes past the colormap allocation when processing crafted .xcf files with small colormaps and out-of-range pixel indices. Both 1-bit and 2-bit per pixel indexed image code paths are affected. The leaked heap bytes are written into the output surface pixel data, potentially exposing memory contents in the rendered image. The vulnerability is fixed in commit 996bf12888925932daace576e09c3053410896f8.

An attacker can craft a malicious .xcf image file that triggers heap out-of-bounds reads during image loading, causing memory beyond the colormap to be leaked into the rendered image surface. This can lead to exposure of sensitive memory contents (confidentiality impact). There is no indication of integrity or availability impact. The CVSS score is 7.1 (high), reflecting network attack vector, low complexity, no privileges required, user interaction required, and high confidentiality impact.

A fix for this vulnerability is available and included in commit 996bf12888925932daace576e09c3053410896f8. Users should update SDL_image to a version that includes this commit or later. Since this is a library, integrating the patched version into dependent projects is necessary to mitigate the issue. No other vendor advisory or temporary fix information is provided. Patch status is confirmed by the vendor commit reference.