CVE-2026-54626 Details
Description
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_RLE path selected by image_type == 9 allocates an image buffer using the one-byte-per-pixel SAIL_PIXEL_FORMAT_BPP8_INDEXED format returned by tga_private_sail_pixel_format() in src/sail-codecs/tga/helpers.c, while sail_codec_load_frame_v8_tga() in src/sail-codecs/tga/tga.c derives a two-to-four-byte pixel_size from an attacker-controlled header bpp value from 9 through 32. Loading a crafted color-mapped run-length-encoded TGA through sail_load_from_file() or sail_load_from_memory() therefore writes attacker-controlled bytes beyond the heap pixel buffer. The pixel-count clamp added for CVE-2026-40494 does not constrain the per-pixel write width, so this issue is an incomplete fix of that vulnerability and can cause heap corruption, a reliable crash, or potential code execution. This issue is fixed in version 1.0.0.
A heap out-of-bounds write vulnerability has been identified in the SAIL library, specifically in the TGA decoder for color-mapped run-length-encoded TGA files. This vulnerability exists in versions through 0.9.10. The issue arises because the decoder allocates a pixel buffer based on a one-byte-per-pixel format, while the RLE decoder writes multiple bytes per pixel based on an attacker-controlled header value. This mismatch allows for writing beyond the allocated buffer, leading to heap corruption. The vulnerability can be exploited by any application that uses SAIL to load untrusted TGA images, potentially causing a crash or allowing for remote code execution.
Users are advised to update to SAIL version 1.0.0, which addresses this vulnerability by ensuring that the bytes-per-pixel value is properly validated before processing the image data.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HappySeaFox/sail/security/advisories/GHSA-744p-cqg2-m33h | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/HappySeaFox/sail/commit/fa24bceb93958ad665dbc3cf6b49a1079ab12559 | [email protected] | Source CodeVendor |
| https://github.com/HappySeaFox/sail/releases/tag/v1.0.0 | [email protected] | Release NotesVendor |
| https://github.com/HappySeaFox/sail/security/advisories/GHSA-744p-cqg2-m33h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HappySeaFox SAIL | <= 0.9.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |