CVE-2026-54627
CriticalCVSS 9.8Summary
SAIL library version 0.9.10 and earlier contains a mode/depth mismatch when loading Bitmap-mode PSD files. psd_private_sail_pixel_format() returns a one-bit format while the loader accepts depth 8, causing out-of-bounds heap writes that lead to memory corruption, crashes, or potential code execution.
Risk Assessment
Loading a crafted PSD file through an application using SAIL can lead to remote code execution or crashes, threatening confidentiality, integrity, and availability of the system.
Recommendation
Update the SAIL library to version 1.0.0 or later, which fixes this mismatch.
Other vulnerabilities in SAIL
See all- CVE-2026-54692High
In SAIL before version 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row that the destination buffer cannot hold, resulting in a forward heap overwrite that scales with image height. The issue is fixed in version 1.0.0.
- CVE-2026-54626Critical
SAIL library version 0.9.10 and earlier contains an incomplete fix for CVE-2026-40494 in the TGA_INDEXED_RLE path. The image buffer is allocated as one byte per pixel, but the loader derives a wider pixel size from an attacker-controlled bpp value, leading to out-of-bounds heap writes and memory corruption.
Original NVD description (English source)
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psd_private_sail_pixel_format() in src/sail-codecs/psd/helpers.c resolves a one-channel PSD in Bitmap color mode to SAIL_PIXEL_FORMAT_BPP1_INDEXED without requiring the file depth to be one, so the pixel buffer uses one-bit rows while sail_codec_load_frame_v8_psd() in src/sail-codecs/psd/psd.c accepts depth == 8 and writes one attacker-controlled byte per pixel. Loading a crafted PSD through sail_load_from_file() or sail_load_from_memory() therefore writes beyond each heap row, causing memory corruption, a reliable crash, or potential code execution. This mode/depth mismatch is distinct from GHSA-rcqx-gc76-r9mv and GHSA-wcj8-hxxf-pq2c. This issue is fixed in version 1.0.0.