Vulnerability · Published Aug 25, 2025 · Assigned by talos
CVE-2025-35984
High 8.8
In plain English
A high-severity heap buffer overflow in SAIL Image Decoding Library from SAIL Image Decoding Library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decoding the image data from a specially crafted .pcx file, a heap-based buffer overflow can occur which allows for remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | sail | 0.9.8-1+deb13u1 | DEBIAN-CVE-2025-35984 |
| Debian:14 | sail | 0.9.9-1 | DEBIAN-CVE-2025-35984 |
| Ubuntu:24.04:LTS | sail | no fix listed | UBUNTU-CVE-2025-35984 |
| Ubuntu:25.10 | sail | no fix listed | UBUNTU-CVE-2025-35984 |
| Ubuntu:26.10 | sail | no fix listed | UBUNTU-CVE-2025-35984 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAIL Image Decoding Library | SAIL Image Decoding Library | v0.9.8 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H