Sail - CraftedSignal Threat Feed

SAIL Library XWD Codec Out-of-Bounds Read Vulnerability (CVE-2026-40492)

hello@craftedsignal.io — Wed, 24 Jan 2024 12:00:00 +0000

The SAIL (Simple API for Images Loading) library, a cross-platform tool used for loading and saving images, contains a critical vulnerability (CVE-2026-40492) within its XWD codec. This flaw stems from inconsistent handling of pixel format (pixmap_depth) and bit depth (bits_per_pixel) during image processing. Specifically, the byte-swap code within the XWD codec incorrectly accesses memory when pixmap_depth is set to 8 (indicating 1 byte per pixel) while bits_per_pixel is set to 32. This discrepancy causes the code to read and write 4x the allocated buffer size, resulting in an out-of-bounds memory access. This is a distinct vulnerability from CVE-2026-27168. The vulnerability was patched in commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02. Successful exploitation could lead to application crashes, denial-of-service, or potentially arbitrary code execution.

Attack Chain

An attacker crafts a malicious XWD image file with pixmap_depth set to 8 and bits_per_pixel set to 32.
A user or application unknowingly processes the malicious XWD image file using the vulnerable SAIL library.
The SAIL library's XWD codec attempts to decode the image.
During the byte-swapping process, the codec incorrectly calculates the memory access size based on bits_per_pixel (32) while using a buffer size based on pixmap_depth (8).
The byte-swap loop attempts to read and write 4 bytes per pixel, exceeding the allocated buffer size.
This results in an out-of-bounds read and write operation, potentially overwriting adjacent memory regions.
If the overwritten memory contains critical data or executable code, it could lead to application instability or code execution.
The attacker achieves denial of service or potentially gains control of the affected system.

Impact

Successful exploitation of CVE-2026-40492 can have severe consequences. An attacker could cause applications using the SAIL library to crash, leading to denial of service. In more severe scenarios, the out-of-bounds write could be leveraged to execute arbitrary code, potentially allowing the attacker to gain control of the affected system. The number of potential victims is broad, as the SAIL library is used across multiple platforms and applications that process image files. Sectors that rely heavily on image processing, such as graphic design, medical imaging, and digital photography, are particularly at risk.

Recommendation

Upgrade the SAIL library to a version containing commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 or later to patch CVE-2026-40492.
Monitor applications that use the SAIL library for unexpected crashes or memory access violations (requires robust application logging).
Consider implementing input validation on image files to ensure that pixmap_depth and bits_per_pixel values are consistent and within expected ranges, though this is not a complete defense and requires careful implementation.

SAIL Library TGA RLE Decoder Heap Overflow Vulnerability

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

The SAIL library, a cross-platform solution for image loading and saving, is susceptible to a critical vulnerability (CVE-2026-40494) affecting versions prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302. The vulnerability resides within the Truevision Graphics Adapter (TGA) codec's Run-Length Encoding (RLE) decoder specifically in tga.c. The flaw stems from an asymmetric bounds check in the RLE decoder. While the run-packet path includes necessary bounds checking, the raw-packet path lacks this safeguard. This omission allows a malicious actor to craft a TGA image that, when processed by a vulnerable application, triggers a heap overflow by writing up to 496 bytes beyond the allocated buffer. This vulnerability poses a significant risk as it can be exploited to achieve arbitrary code execution and privilege escalation on systems utilizing the affected SAIL library. The scope of targeting includes any application utilizing the vulnerable SAIL library on Windows, Linux, or macOS.

Attack Chain

An attacker crafts a malicious TGA image file exploiting the missing bounds check in the RLE decoder's raw-packet path.
The attacker delivers the malicious TGA image to a target system, potentially via a website upload, email attachment, or other file transfer mechanisms.
A vulnerable application using the SAIL library attempts to load the malicious TGA image.
The TGA codec's RLE decoder processes the image data within tga.c.
Due to the absence of bounds checking in the raw-packet path (lines 305-311), the decoder writes attacker-controlled data beyond the allocated heap buffer.
The heap overflow corrupts adjacent memory regions, potentially overwriting critical data structures or function pointers.
The corrupted memory leads to a crash or, more critically, allows the attacker to hijack program execution.
Successful exploitation enables the attacker to execute arbitrary code with the privileges of the vulnerable application, leading to privilege escalation.

Impact

Successful exploitation of CVE-2026-40494 allows an attacker to achieve arbitrary code execution with the privileges of the application using the vulnerable SAIL library. The impact is severe, as it can lead to complete system compromise, data exfiltration, or denial of service. The number of potential victims is broad, including any user or organization employing applications that rely on the affected SAIL library for image processing across various sectors. While specific victim numbers remain unknown, the cross-platform nature of the library suggests widespread potential impact.

Recommendation

Upgrade the SAIL library to a version containing the fix for CVE-2026-40494, specifically commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302.
Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts.
Implement input validation and sanitization measures to restrict the types and sizes of image files processed by applications using the SAIL library.
Monitor applications using the SAIL library for unexpected crashes or abnormal behavior, which could indicate exploitation attempts.
Enable process creation logging with command line arguments to allow detection of suspicious processes spawned by applications processing images.

SAIL Library PSD Codec Heap Buffer Overflow Vulnerability (CVE-2026-40493)

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

SAIL (Simple API for Images Loading) is a cross-platform library used for loading and saving images, supporting features like animation, metadata handling, and ICC profiles. A critical vulnerability, CVE-2026-40493, has been identified within the PSD codec of SAIL. This flaw stems from an inconsistency in how the library calculates bytes per pixel (bpp) compared to the actual memory allocated for pixel data. Specifically, when processing images in LAB mode with channels=3 and depth=16, the computed bpp value doesn't align with the memory allocated by the BPP40_CIE_LAB format, resulting in a heap buffer overflow during pixel write operations. The vulnerability affects versions prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, which contains the necessary patch to resolve this issue. Successful exploitation could lead to arbitrary code execution.

Attack Chain

An attacker crafts a malicious PSD image specifically designed to trigger the vulnerability. This image is created with LAB color mode, 3 channels, and a depth of 16 bits per channel.
The victim application utilizes the SAIL library to load the crafted PSD image. This could be a photo editor, image viewer, or any other software incorporating SAIL for image processing.
The PSD codec within SAIL calculates the bpp value based on the channels and depth header fields. In this specific case, the calculation results in a bpp value of 6.
The pixel buffer is allocated based on the resolved pixel format, BPP40_CIE_LAB, which allocates only 5 bytes per pixel.
During pixel writing, the code attempts to write 6 bytes of data into a buffer allocated for only 5 bytes, resulting in a one-byte heap buffer overflow. This overflow occurs deterministically on every row of the image.
The heap buffer overflow corrupts adjacent memory regions on the heap.
Depending on the overwritten data, the attacker could potentially gain control of program execution by overwriting function pointers or other critical data structures.
The attacker achieves arbitrary code execution on the victim's machine, leading to system compromise.

Impact

Successful exploitation of CVE-2026-40493 allows an attacker to achieve arbitrary code execution on a vulnerable system. This could lead to complete system compromise, data exfiltration, or denial-of-service. Applications that rely on the SAIL library to process PSD images are at risk. The vulnerability's high CVSS score (9.8) indicates its critical severity and potential for widespread impact. The number of affected systems depends on the adoption rate of the SAIL library in various software applications across different sectors.

Recommendation

Upgrade to a version of SAIL that includes commit c930284445ea3ff94451ccd7a57c999eca3bc979 or later to patch CVE-2026-40493.
Monitor applications that use the SAIL library for unexpected crashes or anomalous behavior, which could indicate exploitation attempts. Enable process creation logging (Sysmon on Windows) to activate the rule detecting abnormal processes spawned by image processing applications.
Deploy the Sigma rule Detect SAIL PSD Heap Overflow to identify potential exploitation attempts based on process creation events.