PT-2026-33585 · Happyseafox · Sail

Published 2026-04-18 · Updated 2026-04-18 · CVE-2026-40492

Mitre

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, the XWD codec resolves pixel format based on pixmap depth but the byte-swap code uses bits per pixel independently. When pixmap depth=8 (BPP8 INDEXED, 1 byte/pixel buffer) but bits per pixel=32, the byte-swap loop accesses memory as uint32 t*, reading/writing 4x the allocated buffer size. This is a different vulnerability from the previously reported GHSA-3g38-x2pj-mv55 (CVE-2026-27168), which addressed bytes per line validation. Commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 contains a patch.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-40492

Affected Products

Sail

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40492 · Security Note
• https://github.com/HappySeaFox/sail/security/advisories/GHSA-526v-vm72-4v64 · Note
• https://github.com/HappySeaFox/sail/commit/36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 · Note