CVE-2026-59959
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the SAIL library prior to 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or ANMF frame metadata. A zero image width is used as a divisor when computing bytes_per_pixel, causing an arithmetic fault and process termination.
Risk Assessment
Applications accepting untrusted WebP images may suffer denial of service due to process termination; builds must include the affected WebP codec.
Recommendation
Update the SAIL library to version 1.0.2 or later, which fixes the WebP decoder issue.
Other vulnerabilities in SAIL
See all- CVE-2026-54627Critical
SAIL library version 0.9.10 and earlier contains a mode/depth mismatch when loading Bitmap-mode PSD files. psd_private_sail_pixel_format() returns a one-bit format while the loader accepts depth 8, causing out-of-bounds heap writes that lead to memory corruption, crashes, or potential code execution.
- CVE-2026-54626Critical
SAIL library version 0.9.10 and earlier contains an incomplete fix for CVE-2026-40494 in the TGA_INDEXED_RLE path. The image buffer is allocated as one byte per pixel, but the loader derives a wider pixel size from an attacker-controlled bpp value, leading to out-of-bounds heap writes and memory corruption.
- CVE-2026-54692High
In SAIL before version 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row that the destination buffer cannot hold, resulting in a forward heap overwrite that scales with image height. The issue is fixed in version 1.0.0.
Original NVD description (English source)
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or `ANMF` frame metadata. In `sail_codec_load_init_v8_webp()` in `src/sail-codecs/webp/webp.c`, `WebPDemuxGetI` with `WEBP_FF_CANVAS_WIDTH` can return a zero `image_local->width`, which is then used as a divisor when calculating `bytes_per_pixel` from the image row size. The division happens before frame decoding and before generic image skeleton validation in `src/sail/sail_advanced.c`, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS