CVE-2026-54692 Details
Description
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row, but the destination has no space for those bytes, so loading the XBM through sail_load_from_file, sail_load_from_memory, or sail_start_loading_* produces a forward heap overwrite that scales with image height. The X11 static char path is not affected. The overwrite can corrupt process state, cause reliable crashes, and potentially enable code execution in a susceptible consuming application. This issue is fixed in version 1.0.0.
A heap-based buffer overflow vulnerability has been identified in the SAIL library's XBM codec, prior to version 1.0.0. The issue arises when the decoder processes X10 static short files, which cause the decoding loop to write two bytes per hex literal into a buffer allocated for one byte per literal. This discrepancy leads to a controlled heap overflow that scales with the image height. The vulnerability can be exploited by loading a crafted XBM file through any of the SAIL load functions, such as sail_load_from_file or sail_load_from_memory.
Users can update to SAIL version 1.0.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HappySeaFox/sail/security/advisories/GHSA-gp27-qv2x-55v5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/HappySeaFox/sail/commit/2991e18f806cf038038ee1ef9b08aa5d57480de1 | [email protected] | Source CodeVendor |
| https://github.com/HappySeaFox/sail/releases/tag/v1.0.0 | [email protected] | Release NotesVendor |
| https://github.com/HappySeaFox/sail/security/advisories/GHSA-gp27-qv2x-55v5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-131 | Incorrect Calculation of Buffer Size | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HappySeaFox SAIL | < 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |