Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-54627: Sail image library can corrupt memory when reading PSD files
CVE-2026-54627 · published 3 days ago
Summary
The Sail library used for loading and saving images may write outside its memory when opening specially crafted Photoshop PSD files. This can cause the program to crash or, in rare cases, allow an attacker to run code. Upgrade Sail to version 1.0.0 or later to fix the issue.
What to do
- Update debian sail to version 1.2.0-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | happyseafox | sail | < 1.0.0 |
| Debian:13 | debian | sail | All versions |
| Debian:14 | debian | sail |
< 1.2.0-1 Fix: upgrade to 1.2.0-1
|
Original advisory text
SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psd_private_sail_pixel_format() in src/sail-codecs/psd/helpers.c resolves a one-channel PSD in Bitmap color mode to SAIL_PIXEL_FORMAT_BPP1_INDEXED without requiring the file depth to be one, so the pixel buffer uses one-bit rows while sail_codec_load_frame_v8_psd() in src/sail-codecs/psd/psd.c accepts depth == 8 and writes one attacker-controlled byte per pixel. Loading a crafted PSD through sail_load_from_file() or sail_load_from_memory() therefore writes beyond each heap row, causing memory corruption, a reliable crash, or potential code execution. This mode/depth mismatch is distinct from GHSA-rcqx-gc76-r9mv and GHSA-wcj8-hxxf-pq2c. This issue is fixed in version 1.0.0.
References
- https://github.com/HappySeaFox/sail/commit/f44a8b779a1fc527fc6bc5caa71a66a8ed940... Patch
- https://github.com/HappySeaFox/sail/releases/tag/v1.0.0 URL
- https://github.com/HappySeaFox/sail/security/advisories/GHSA-ccqf-rv86-h3wm Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54627... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-54627 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-54627 Vendor Advisory
Severity
9.8
Critical
CVSS 3.1: 9.8 (NVD)
Exploitation
EPSS <1%
Type
CWE-122Heap-based Buffer Overflow
CWE-787Out-of-bounds Write
Timeline
Published17 Sep 2026
Updated21 Sep 2026
First seen17 Sep 2026
Sources
CVE-2026-54627 · NVD
CVE-2026-54627 · MITRE
CVE-2026-54627 · OSV
GHSA-ccqf-rv86-h3wm · GHSA
DEBIAN-CVE-2026-54627 · OSV
Track software like this
Free during beta