CVE-2026-27168
HighSummary
SAIL to wieloplatformowa biblioteka do ładowania i zapisywania obrazów, która jest podatna na przepełnienie bufora w stercie poprzez parser XWD. Wartość bytes_per_line jest odczytywana bezpośrednio z pliku i nie jest porównywana z rzeczywistym rozmiarem bufora docelowego, co umożliwia atakującemu dostarczenie pliku XWD z dowolnie dużą wartością bytes_per_line.
Risk Assessment
Atakujący może wykorzystać tę podatność do wykonania złośliwego kodu poprzez przepełnienie bufora, co może prowadzić do poważnych naruszeń bezpieczeństwa w systemie. Brak poprawki w momencie publikacji zwiększa ryzyko eksploatacji tej luki.
Recommendation
Zaleca się unikanie używania podatnych wersji biblioteki SAIL oraz monitorowanie dostępnych aktualizacji, które mogą zawierać poprawki dla tej podatności.
Related vulnerabilities
- CVE-2026-87886HighActively exploited
Local privilege escalation due to insecure file permissions. Affects Acronis Backup plugins for cPanel & WHM, Plesk, and DirectAdmin in versions older than the specified builds.
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70200Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69865Critical
Authorization bypass through a user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
Original NVD description (English source)
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. All versions are vulnerable to Heap-based Buffer Overflow through the XWD parser's use of the bytes_per_line value. The value os read directly from the file as the read size in io->strict_read(), and is never compared to the actual size of the destination buffer. An attacker can provide an XWD file with an arbitrarily large bytes_per_line, causing a massive write operation beyond the buffer heap allocated for the image pixels. The issue did not have a fix at the time of publication.