Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54692— SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write)

Quick assessment

Affected
HappySeaFox sail
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SAIL 是一个跨平台图像加载与保存库，支持动画、元数据和 ICC 配置文件。在 1.0.0 版本之前， 中的 函数在分配解码后的像素缓冲区时，采用了 X11 的“每字面量一字节”布局。然而，对于一个 X10 静态短文件（static short file），其扁平化解码循环会为每个字面量写入两个由文件内容控制的字节。 当 计算出的每行字节数为奇数时，X10 格式的字面量计数会包含每行的一个填充字节，但目标缓冲区中并没有为这些字节预留空间。因此，通过 、 或 函数加载 XBM 图像时，会触发向前方向的堆溢出（for

CVSS 7.8 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
HappySeaFox sail < 1.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54692

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write)
Source: CVE Program / CVE List V5
Vulnerability Description
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row, but the destination has no space for those bytes, so loading the XBM through sail_load_from_file, sail_load_from_memory, or sail_start_loading_* produces a forward heap overwrite that scales with image height. The X11 static char path is not affected. The overwrite can corrupt process state, cause reliable crashes, and potentially enable code execution in a susceptible consuming application. This issue is fixed in version 1.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
缓冲区大小计算不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
HappySeaFox sail < 1.0.0 -

II. Public POCs for CVE-2026-54692

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54692

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54692 (1)

Vendor Advisories for CVE-2026-54692 (1)

Vendor Pages for CVE-2026-54692 (1)

Same Patch Batch · HappySeaFox · 2026-09-17 · 3 CVEs total

CVE-2026-54627 9.8 CRITICAL SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)
CVE-2026-54626 9.8 CRITICAL SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)

IV. Related Vulnerabilities

Same product: sail
Same vendor: HappySeaFox
Same weakness: CWE-131

V. Comments for CVE-2026-54692

No comments yet

Leave a comment