CVE-2026-54692
HighCVSS 7.8Summary
In SAIL before version 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row that the destination buffer cannot hold, resulting in a forward heap overwrite that scales with image height. The issue is fixed in version 1.0.0.
Risk Assessment
Loading a malicious XBM file through an application using SAIL can corrupt process state, cause reliable crashes, and potentially enable code execution in the consuming application. Any application processing untrusted XBM images is at risk.
Recommendation
Update the SAIL library to version 1.0.0 or later. Until then, avoid loading untrusted XBM files via sail_load_from_file, sail_load_from_memory, and sail_start_loading_* functions.
Other vulnerabilities in SAIL
See all- CVE-2026-54627Critical
SAIL library version 0.9.10 and earlier contains a mode/depth mismatch when loading Bitmap-mode PSD files. psd_private_sail_pixel_format() returns a one-bit format while the loader accepts depth 8, causing out-of-bounds heap writes that lead to memory corruption, crashes, or potential code execution.
- CVE-2026-54626Critical
SAIL library version 0.9.10 and earlier contains an incomplete fix for CVE-2026-40494 in the TGA_INDEXED_RLE path. The image buffer is allocated as one byte per pixel, but the loader derives a wider pixel size from an attacker-controlled bpp value, leading to out-of-bounds heap writes and memory corruption.
Original NVD description (English source)
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row, but the destination has no space for those bytes, so loading the XBM through sail_load_from_file, sail_load_from_memory, or sail_start_loading_* produces a forward heap overwrite that scales with image height. The X11 static char path is not affected. The overwrite can corrupt process state, cause reliable crashes, and potentially enable code execution in a susceptible consuming application. This issue is fixed in version 1.0.0.