CVE-2019-5051

HIGH

SDL2_image <2.0.4 - Buffer Overflow

Title source: llm

Description

An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability.

References (5)

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html

[Exploit, Third Party Advisory] https://talosintelligence.com/vulnerability_reports/TALOS-2019-0820

[Third Party Advisory] https://usn.ubuntu.com/4238-1/

Scores

CVSS v3 8.8

EPSS 0.0159

EPSS Percentile 81.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

CWE

CWE-390 CWE-755 CWE-787

Status published

Affected Products (8)

libsdl/sdl2_image

debian/debian_linux

opensuse/backports_sle

opensuse/backports_sle

opensuse/leap

opensuse/leap

canonical/ubuntu_linux

canonical/ubuntu_linux

Timeline

Published Jul 03, 2019

Tracked Since Feb 18, 2026