Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:libsdl3-image User: [email protected] Usertags: pu
[ Reason ] Fix CVE-2026-35444 and various other out-of-bounds accesses when parsing malformed/crafted image files [ Impact ] If not fixed, games/applications that load untrusted images using SDL3_image could be subject to denial-of-service (crash) or possibly exploitable. [ Tests ] autopkgtest (automated smoke-tests loading images in various formats) passes, and the showimage sample program from libsdl3-image-tests can load various images on a trixie GNOME desktop. I didn't attempt to obtain malformed/crafted images designed to exploit the robustness issues. [ Risks ] Low risk, hardly anything in trixie uses libsdl3-image: I believe it's only freerdp-sdl, a developer-oriented RDP client with low popcon, which uses it to load images into dialogs. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] All changes are robustness fixes from upstream. Most are fixed in 3.4.2 or 3.4.4 upstream. One is not in an upstream release yet, I backported it into forky already. [ Other info ] Related to https://bugs.debian.org/1134510 for libsdl2-image, an older branch of the same codebase.
