CVE-2026-40492 Details
Description
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, the XWD codec resolves pixel format based on `pixmap_depth` but the byte-swap code uses `bits_per_pixel` independently. When `pixmap_depth=8` (BPP8_INDEXED, 1 byte/pixel buffer) but `bits_per_pixel=32`, the byte-swap loop accesses memory as `uint32_t*`, reading/writing 4x the allocated buffer size. This is a different vulnerability from the previously reported GHSA-3g38-x2pj-mv55 (CVE-2026-27168), which addressed `bytes_per_line` validation. Commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 contains a patch.
A heap buffer overflow vulnerability has been identified in the SAIL library's XWD codec, prior to a specific commit in 2026. The issue arises from a mismatch between how pixel formats are interpreted and how data is processed during byte-swapping. When the 'pixmap_depth' is set to 8 but 'bits_per_pixel' is 32, the byte-swap operation incorrectly accesses memory as 32-bit integers, leading to a buffer overflow by a factor of four. This vulnerability is distinct from another issue previously reported by the same author, which involved improper validation of 'bytes_per_line'.
Users are advised to update to the patched version of the SAIL library, which includes a fix for this vulnerability by ensuring that 'bits_per_pixel' is validated to match the resolved pixel format before any byte-swapping operations are performed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 18, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HappySeaFox/sail/security/advisories/GHSA-526v-vm72-4v64 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/HappySeaFox/sail/commit/36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 | [email protected] | Source CodeVendor |
| https://github.com/HappySeaFox/sail/security/advisories/GHSA-526v-vm72-4v64 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HappySeaFox SAIL | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | CVE Modified | CISA-ADP |
| Apr 18, 2026 | New CVE Received | [email protected] |