Log in Start free

Vulnerability · Published Oct 28, 2026 · Assigned by GitHub_M

CVE-2026-59959SAIL: WebP decoder division by zero through malformed animated canvas metadata

Medium 4.8

In plain English

A medium-severity security flaw in sail from HappySeaFox. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)4.8Medium
Exploit odds (30 days)0.1%top 97.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or `ANMF` frame metadata. In `sail_codec_load_init_v8_webp()` in `src/sail-codecs/webp/webp.c`, `WebPDemuxGetI` with `WEBP_FF_CANVAS_WIDTH` can return a zero `image_local->width`, which is then used as a divisor when calculating `bytes_per_pixel` from the image row size. The division happens before frame decoding and before generic image skeleton validation in `src/sail/sail_advanced.c`, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13sailno fix listedDEBIAN-CVE-2026-59959
Debian:14sail1.2.0-1DEBIAN-CVE-2026-59959

Affected products (as reported)

VendorProductVersions
HappySeaFox sail < 1.0.2

Weakness: CWE-369 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References