CVE-2026-59959 Details
Description
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or `ANMF` frame metadata. In `sail_codec_load_init_v8_webp()` in `src/sail-codecs/webp/webp.c`, `WebPDemuxGetI` with `WEBP_FF_CANVAS_WIDTH` can return a zero `image_local->width`, which is then used as a divisor when calculating `bytes_per_pixel` from the image row size. The division happens before frame decoding and before generic image skeleton validation in `src/sail/sail_advanced.c`, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.
A denial-of-service vulnerability has been identified in the SAIL image decoding library, specifically in versions prior to 1.0.2. The issue arises in the built-in WebP decoder, where the library can crash during the initialization of the loader. This occurs when the decoder processes a malformed animated WebP file that contains inconsistent frame metadata. The WebP demuxer can return a zero width for the canvas, which is then improperly used in a calculation for bytes per pixel, leading to a division by zero error. As a result, applications that handle untrusted WebP images may experience a crash, causing a denial-of-service condition.
Users can update to SAIL version 1.0.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HappySeaFox/sail/security/advisories/GHSA-5g8g-g347-84m8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/HappySeaFox/sail/commit/495660135a4c62e416a1b357a4381dd30069229d | [email protected] | Source CodeVendor |
| https://github.com/HappySeaFox/sail/security/advisories/GHSA-5g8g-g347-84m8 | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/HappySeaFox/sail/tree/v1.0.2 | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-369 | Divide By Zero | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HappySeaFox SAIL | <= 1.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |