Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-54626: happyseafox SAIL library can crash when loading TGA images
CVE-2026-54626 · published 3 days ago
Summary
Versions of the happyseafox SAIL image library up to 0.9.10 may write data past the end of memory when opening specially crafted TGA files. This can corrupt the program, cause it to stop working, or potentially allow malicious code to run. Upgrade to version 1.0.0 or later to resolve the issue.
What to do
- Update debian sail to version 1.2.0-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | happyseafox | sail | < 1.0.0 |
| Debian:13 | debian | sail | All versions |
| Debian:14 | debian | sail |
< 1.2.0-1 Fix: upgrade to 1.2.0-1
|
Original advisory text
SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_RLE path selected by image_type == 9 allocates an image buffer using the one-byte-per-pixel SAIL_PIXEL_FORMAT_BPP8_INDEXED format returned by tga_private_sail_pixel_format() in src/sail-codecs/tga/helpers.c, while sail_codec_load_frame_v8_tga() in src/sail-codecs/tga/tga.c derives a two-to-four-byte pixel_size from an attacker-controlled header bpp value from 9 through 32. Loading a crafted color-mapped run-length-encoded TGA through sail_load_from_file() or sail_load_from_memory() therefore writes attacker-controlled bytes beyond the heap pixel buffer. The pixel-count clamp added for CVE-2026-40494 does not constrain the per-pixel write width, so this issue is an incomplete fix of that vulnerability and can cause heap corruption, a reliable crash, or potential code execution. This issue is fixed in version 1.0.0.
References
- https://github.com/HappySeaFox/sail/commit/fa24bceb93958ad665dbc3cf6b49a1079ab12... Patch
- https://github.com/HappySeaFox/sail/releases/tag/v1.0.0 URL
- https://github.com/HappySeaFox/sail/security/advisories/GHSA-744p-cqg2-m33h Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54626... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-54626 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-54626 Vendor Advisory
Severity
9.8
Critical
CVSS 3.1: 9.8 (NVD)
Exploitation
EPSS <1%
Type
CWE-122Heap-based Buffer Overflow
CWE-787Out-of-bounds Write
Timeline
Published17 Sep 2026
Updated21 Sep 2026
First seen17 Sep 2026
Sources
CVE-2026-54626 · NVD
CVE-2026-54626 · MITRE
CVE-2026-54626 · OSV
GHSA-744p-cqg2-m33h · GHSA
DEBIAN-CVE-2026-54626 · OSV
Track software like this
Free during beta