by Kastro
Paper/Archive/CVE-2026-40493

CVE-2026-40493

HappySeaFox sail — SAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit mode

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 30.6.306 × 206.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, the PSD codec computes bytes-per-pixel (`bpp`) from raw header fields `channels * depth`, but the pixel buffer is allocated based on the resolved pixel format. For LAB mode with `channels=3, depth=16`, `bpp = (3*16+7)/8 = 6`, but the format `BPP40_CIE_LAB` allocates only 5 bytes per pixel. Every pixel write overshoots, causing a deterministic heap buffer overflow on every row. Commit c930284445ea3ff94451ccd7a57c999eca3bc979 contains a patch.

Affected

ProductAffectedFixed inSource
sail< c930284445ea3ff94451ccd7a57c999eca3bc979–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/HappySeaFox/sail/security/advisories/GHSA-rcqx-gc76-r9mvrefgithub.com/HappySeaFox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979