Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2026-54627— SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)

Quick assessment

Affected

HappySeaFox sail

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SAIL 是一个用于加载和保存图像的跨平台库，支持动画、元数据以及 ICC 配置文件。在 0.9.10 及更早版本中，文件中的函数在处理处于“位图”（Bitmap）颜色模式的单通道 PSD 文件时，会将其解析为，但并未要求文件的实际位深度（depth）必须为 1。这导致像素缓冲区采用单比特（1-bit）行进行存储，而文件中的函数却允许深度等于 8，并为每个像素写入一个由攻击者控制的字节。因此，通过或加载恶意构造的 PSD 文件时，会导致堆内存越界写入，进而引发内存损坏、可靠的程序崩溃，甚至可能被利用执

CVSS 9.8 · Critical Updated Sep 18, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
HappySeaFox	sail	`< 1.0.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)

Source: CVE Program / CVE List V5

Vulnerability Description

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psd_private_sail_pixel_format() in src/sail-codecs/psd/helpers.c resolves a one-channel PSD in Bitmap color mode to SAIL_PIXEL_FORMAT_BPP1_INDEXED without requiring the file depth to be one, so the pixel buffer uses one-bit rows while sail_codec_load_frame_v8_psd() in src/sail-codecs/psd/psd.c accepts depth == 8 and writes one attacker-controlled byte per pixel. Loading a crafted PSD through sail_load_from_file() or sail_load_from_memory() therefore writes beyond each heap row, causing memory corruption, a reliable crash, or potential code execution. This mode/depth mismatch is distinct from GHSA-rcqx-gc76-r9mv and GHSA-wcj8-hxxf-pq2c. This issue is fixed in version 1.0.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

堆缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
HappySeaFox	sail	< 1.0.0	-

II. Public POCs for CVE-2026-54627

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-54627

请登录查看更多情报信息。

Same Patch Batch · HappySeaFox · 2026-09-17 · 3 CVEs total

CVE-2026-54626	9.8 CRITICAL	SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)
CVE-2026-54692	7.8 HIGH	SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap ou

IV. Related Vulnerabilities

Same product: sail

Same vendor: HappySeaFox

Same weakness: CWE-122

V. Comments for CVE-2026-54627

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-54627— SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 1

I. Basic Information for CVE-2026-54627

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-54627

III. Intelligence Information for CVE-2026-54627

Patches & Fixes for CVE-2026-54627 (1)

Vendor Advisories for CVE-2026-54627 (1)

Vendor Pages for CVE-2026-54627 (1)

Same Patch Batch · HappySeaFox · 2026-09-17 · 3 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-54627

Leave a comment