Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M
CVE-2026-54692SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write)
High 7.8
In plain English
A high-severity out-of-bounds write in sail from HappySeaFox. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row, but the destination has no space for those bytes, so loading the XBM through sail_load_from_file, sail_load_from_memory, or sail_start_loading_* produces a forward heap overwrite that scales with image height. The X11 static char path is not affected. The overwrite can corrupt process state, cause reliable crashes, and potentially enable code execution in a susceptible consuming application. This issue is fixed in version 1.0.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | sail | no fix listed | DEBIAN-CVE-2026-54692 |
| Debian:14 | sail | 1.2.0-1 | DEBIAN-CVE-2026-54692 |
| Ubuntu:24.04:LTS | sail | no fix listed | UBUNTU-CVE-2026-54692 |
| Ubuntu:26.04:LTS | sail | no fix listed | UBUNTU-CVE-2026-54692 |
| Ubuntu:26.10 | sail | no fix listed | UBUNTU-CVE-2026-54692 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HappySeaFox | sail | < 1.0.0 |
Weakness: CWE-131, CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/HappySeaFox/sail/security/advisories/GHSA-gp27-qv2x-55v5 x_refsource_CONFIRM
- https://github.com/HappySeaFox/sail/commit/2991e18f806cf038038ee1ef9b08aa5d57480de1 x_refsource_MISC
- https://github.com/HappySeaFox/sail/releases/tag/v1.0.0 x_refsource_MISC