SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed with commit 996bf12888925932daace576e09c3053410896f8.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6f328b5020 advisory.

    Update to SDL2_image 2.8.12, fixes CVE-2026-35444.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-bc38ebdf4c advisory.

    Update to SDL2_image 2.8.12, fixes CVE-2026-35444.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8ac58f5cf3 advisory.

    Update to bugfix release 2.8.12.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f1f87b465a advisory.

    Update to bugfix release 2.8.12.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7fe0476df9 advisory.

    Update to bugfix release 2.8.12.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0f01e844c3 advisory.

    Update to 3.4.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-992a75bea6 advisory.

    Update to 3.4.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in     src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without     validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-     range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both     IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are written into the output     surface pixel data, making them potentially observable in the rendered image. This vulnerability is fixed     with commit 996bf12888925932daace576e09c3053410896f8. (CVE-2026-35444)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321864	Fedora 44 : mingw-SDL2_image (2026-6f328b5020)	Nessus	Fedora Local Security Checks	medium
321860	Fedora 43 : mingw-SDL2_image (2026-bc38ebdf4c)	Nessus	Fedora Local Security Checks	medium
315298	Fedora 42 : SDL2_image (2026-8ac58f5cf3)	Nessus	Fedora Local Security Checks	medium
315296	Fedora 43 : SDL2_image (2026-f1f87b465a)	Nessus	Fedora Local Security Checks	medium
314529	Fedora 44 : SDL2_image (2026-7fe0476df9)	Nessus	Fedora Local Security Checks	medium
313732	Fedora 43 : SDL3_image (2026-0f01e844c3)	Nessus	Fedora Local Security Checks	medium
313409	Fedora 44 : SDL3_image (2026-992a75bea6)	Nessus	Fedora Local Security Checks	medium
305228	Linux Distros Unpatched Vulnerability : CVE-2026-35444	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-35444

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium