CVE-2026-40493
SAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit mode
Description
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, the PSD codec computes bytes-per-pixel (`bpp`) from raw header fields `channels * depth`, but the pixel buffer is allocated based on the resolved pixel format. For LAB mode with `channels=3, depth=16`, `bpp = (3*16+7)/8 = 6`, but the format `BPP40_CIE_LAB` allocates only 5 bytes per pixel. Every pixel write overshoots, causing a deterministic heap buffer overflow on every row. Commit c930284445ea3ff94451ccd7a57c999eca3bc979 contains a patch.
INFO
Published Date :
April 18, 2026, 3:16 a.m.
Last Modified :
Oct. 26, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | [email protected] |
Solution
- Update the SAIL library to the patched version.
- Verify the integrity of the image loading process.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-40493.
| URL | Resource |
|---|---|
| https://github.com/HappySeaFox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979 | |
| https://github.com/HappySeaFox/sail/security/advisories/GHSA-rcqx-gc76-r9mv |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-40493 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-40493
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-40493 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-40493 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: sail de HappySeaFox, Description: SAIL es una biblioteca multiplataforma para cargar y guardar imágenes con soporte para animación, metadatos y perfiles ICC. Antes del commit c930284445ea3ff94451ccd7a57c999eca3bc979, el códec PSD calcula los bytes por píxel (’bpp’) a partir de los campos de encabezado sin procesar ’channels * depth’, pero el búfer de píxeles se asigna basándose en el formato de píxel resuelto. Para el modo LAB con ’channels=3, depth=16’, ’bpp = (316+7)/8 = 6’, pero el formato ’BPP40_CIE_LAB’ asigna solo 5 bytes por píxel. Cada escritura de píxel se excede, causando un desbordamiento de búfer de pila determinista en cada fila. El commit c930284445ea3ff94451ccd7a57c999eca3bc979 contiene un parche. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'HappySeaFox', 'product': 'sail', 'versions': [{'status': 'affected', 'version': '< c930284445ea3ff94451ccd7a57c999eca3bc979'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-40493', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-04-20T16:11:59.642196Z'} -
New CVE Received by [email protected]
Apr. 18, 2026
Action Type Old Value New Value Added Description SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, the PSD codec computes bytes-per-pixel (`bpp`) from raw header fields `channels * depth`, but the pixel buffer is allocated based on the resolved pixel format. For LAB mode with `channels=3, depth=16`, `bpp = (3*16+7)/8 = 6`, but the format `BPP40_CIE_LAB` allocates only 5 bytes per pixel. Every pixel write overshoots, causing a deterministic heap buffer overflow on every row. Commit c930284445ea3ff94451ccd7a57c999eca3bc979 contains a patch. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-787 Added Reference https://github.com/HappySeaFox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979 Added Reference https://github.com/HappySeaFox/sail/security/advisories/GHSA-rcqx-gc76-r9mv