diff --git a/pkgs/development/libraries/SDL_image/default.nix b/pkgs/development/libraries/SDL_image/default.nix
index 62af47807cc2..55a4058fe56d 100644
--- a/pkgs/development/libraries/SDL_image/default.nix
+++ b/pkgs/development/libraries/SDL_image/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, SDL, libpng, libjpeg, libtiff, libungif, libXpm }:
+{ stdenv, fetchurl, fetchpatch, SDL, libpng, libjpeg, libtiff, libungif, libXpm }:
 
 stdenv.mkDerivation rec {
   name = "SDL_image-${version}";
@@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "16an9slbb8ci7d89wakkmyfvp7c0cval8xw4hkg0842nhhlp540b";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2017-2887";
+      url = "https://hg.libsdl.org/SDL_image/raw-diff/318484db0705/IMG_xcf.c";
+      sha256 = "140dyszz9hkpgwjdiwp1b7jdd8f8l5d862xdaf3ml4cimga1h5kv";
+    })
+  ];
+
   buildInputs = [ SDL libpng libjpeg libtiff libungif libXpm ];
 
   meta = with stdenv.lib; {