Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54626— SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)

Quick assessment

Affected
HappySeaFox sail
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SAIL 是一个用于加载和保存图像的跨平台库，支持动画、元数据和 ICC 配置文件。在 0.9.10 及更早版本中，当 时，TGA_INDEXED_RLE 路径会通过 中 返回的单字节/像素的 格式分配图像缓冲区；而 中的 则根据攻击者可控的 TGA 文件头中的 bpp（每像素位深）值（范围为 9 到 32）推导出 2 到 4 字节的 。因此，通过 或 加载一个精心构造的、采用颜色映射和游程编码的 TGA 文件时，会将攻击者可控的数据写入堆上图像缓冲区之外的内存区域。针对 CVE-2026-40494 添加的像素数

CVSS 9.8 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
HappySeaFox sail < 1.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54626

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)
Source: CVE Program / CVE List V5
Vulnerability Description
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_RLE path selected by image_type == 9 allocates an image buffer using the one-byte-per-pixel SAIL_PIXEL_FORMAT_BPP8_INDEXED format returned by tga_private_sail_pixel_format() in src/sail-codecs/tga/helpers.c, while sail_codec_load_frame_v8_tga() in src/sail-codecs/tga/tga.c derives a two-to-four-byte pixel_size from an attacker-controlled header bpp value from 9 through 32. Loading a crafted color-mapped run-length-encoded TGA through sail_load_from_file() or sail_load_from_memory() therefore writes attacker-controlled bytes beyond the heap pixel buffer. The pixel-count clamp added for CVE-2026-40494 does not constrain the per-pixel write width, so this issue is an incomplete fix of that vulnerability and can cause heap corruption, a reliable crash, or potential code execution. This issue is fixed in version 1.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
HappySeaFox sail < 1.0.0 -

II. Public POCs for CVE-2026-54626

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54626

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54626 (1)

Vendor Advisories for CVE-2026-54626 (1)

Vendor Pages for CVE-2026-54626 (1)

Same Patch Batch · HappySeaFox · 2026-09-17 · 3 CVEs total

CVE-2026-54627 9.8 CRITICAL SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)
CVE-2026-54692 7.8 HIGH SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap ou

IV. Related Vulnerabilities

Same product: sail
Same vendor: HappySeaFox
Same weakness: CWE-122

V. Comments for CVE-2026-54626

No comments yet

Leave a comment