Vulnerability · Published Aug 25, 2025 · Assigned by talos
CVE-2025-32468
High 8.8
In plain English
A high-severity security flaw in SAIL Image Decoding Library from SAIL Image Decoding Library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A memory corruption vulnerability exists in the BMPv3 Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .bmp file, an integer overflow can be made to occur when calculating the stride for decoding. Afterwards, this will cause a heap-based buffer to overflow when decoding the image which can lead to remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | sail | 0.9.8-1+deb13u1 | DEBIAN-CVE-2025-32468 |
| Debian:14 | sail | 0.9.9-1 | DEBIAN-CVE-2025-32468 |
| Ubuntu:24.04:LTS | sail | no fix listed | UBUNTU-CVE-2025-32468 |
| Ubuntu:25.10 | sail | no fix listed | UBUNTU-CVE-2025-32468 |
| Ubuntu:26.10 | sail | no fix listed | UBUNTU-CVE-2025-32468 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAIL Image Decoding Library | SAIL Image Decoding Library | v0.9.8 |
Weakness: CWE-680 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H