CVE-2026-27168: falha de alta gravidade em HappySeaFox sail
SAIL: Heap-based Buffer Overflow in Sail-codecs-xwd
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.4%
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. All versions are vulnerable to Heap-based Buffer Overflow through the XWD parser's use of the bytes_per_line value. The value os read directly from the file as the read size in io->strict_read(), and is never compared to the actual size of the destination buffer. An attacker can provide an XWD file with an arbitrarily large bytes_per_line, causing a massive write operation beyond the buffer heap allocated for the image pixels. The issue did not have a fix at the time of publication.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
HappySeaFox · sailCVEs relacionadas — HappySeaFox sail
No mesmo produto, das mais perigosas para as menos.
CVE-2026-54627CRITICALSAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)EPSS 0.8%CVE-2026-54626CRITICALSAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)EPSS 0.8%CVE-2026-40492CRITICALSAIL has heap buffer overflow in XWD decoder — bits_per_pixel vs pixmap_depth type confusion in byte-swapEPSS 0.4%CVE-2026-40493CRITICALSAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit modeEPSS 0.4%CVE-2026-40494CRITICALSAIL has heap buffer overflow in TGA RLE decoder — raw packet path missing bounds checkEPSS 0.3%CVE-2026-54692HIGHSAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write)EPSS 0.2%