CVE-2026-35444

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>sdl_image</name>
	<range><lt>2026-04-02</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>SDL_image is a library to load images of various formats as SDL
	surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values
	from decoded XCF tile data are used directly as colormap indices
	without validating them against the colormap size (cm_num). A crafted
	.xcf file with a small colormap and out-of-range pixel indices causes
	heap out-of-bounds reads of up to 762 bytes past the colormap
	allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and
	bpp=2). The leaked heap bytes are written into the output surface
	pixel data, making them potentially observable in the rendered image.
	This vulnerability is fixed with commit
	996bf12888925932daace576e09c3053410896f8.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-35444</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-35444</url>
    </references>
    <dates>
      <discovery>2026-04-06</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>