What is the CVSS score of CVE-2026-40492?

CVE-2026-40492 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sail are affected by CVE-2026-40492?

CVE-2026-40492 is a critical remote code execution vulnerability in the SAIL image library's XWD codec that allows unauthenticated attackers to execute arbitrary code by sending a malformed image…. A patch is available.

How to fix or mitigate CVE-2026-40492?

Within 24 hours: inventory all systems and applications using SAIL image library and identify those handling XWD image format; disable XWD codec processing if not essential. Within 7 days: apply vendor patch from commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 or later to all affected systems; verify patch deployment. Within 30 days: conduct code review of any image processing workflows to eliminate unnecessary support for legacy formats like XWD, and implement strict file-type validation on all image upload endpoints.

Sail CVE-2026-40492

EUVD-2026-23644 CRITICAL

Out-of-bounds Write (CWE-787)

2026-04-18 GitHub_M

Buffer Overflow Memory Corruption Sail Happyseafox

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 20, 2026 - 18:55 nvd

Patch available

Analysis Updated

Apr 18, 2026 - 03:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 18, 2026 - 03:22 vuln.today

cvss_changed

Patch available

Apr 18, 2026 - 03:01 EUVD

Analysis Generated

Apr 18, 2026 - 02:41 vuln.today

EUVD ID Assigned

Apr 18, 2026 - 02:30 euvd

EUVD-2026-23644

Analysis Generated

Apr 18, 2026 - 02:30 vuln.today

CVE Published

Apr 18, 2026 - 01:39 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, the XWD codec resolves pixel format based on pixmap_depth but the byte-swap code uses bits_per_pixel independently. When pixmap_depth=8 (BPP8_INDEXED, 1 byte/pixel buffer) but bits_per_pixel=32, the byte-swap loop accesses memory as uint32_t*, reading/writing 4x the allocated buffer size. This is a different vulnerability from the previously reported GHSA-3g38-x2pj-mv55 (CVE-2026-27168), which addressed bytes_per_line validation. Commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 contains a patch.

AnalysisAI

Out-of-bounds memory access in SAIL image library's XWD codec allows remote attackers to achieve arbitrary code execution via malformed image files. The vulnerability stems from a pixel format mismatch where buffer allocation uses pixmap_depth=8 (1 byte/pixel) but byte-swap operations use bits_per_pixel=32 (4 bytes/pixel), causing 4x buffer overrun. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation requiring only delivery of a crafted XWD file. EPSS data unavailable; no KEV listing indicates targeted rather than widespread exploitation. Fix available in commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02.

Technical ContextAI

SAIL is a cross-platform image codec library supporting multiple formats including X Window Dump (XWD). The vulnerability (CWE-787: Out-of-bounds Write) occurs in the XWD decoder's pixel format resolution logic. XWD files contain two critical fields: pixmap_depth (bits per pixel for color depth) and bits_per_pixel (actual storage size). SAIL's codec correctly allocates buffers based on pixmap_depth but performs byte-swapping operations based on bits_per_pixel. When a malicious XWD file specifies pixmap_depth=8 (triggering BPP8_INDEXED mode with 1-byte-per-pixel buffer allocation) but bits_per_pixel=32, the byte-swap routine casts the buffer pointer to uint32_t* and processes it as 4-byte units. This type confusion causes reads and writes extending 4x beyond the allocated buffer boundary. This differs from CVE-2026-27168 (GHSA-3g38-x2pj-mv55), which addressed bytes_per_line validation in the same codec. The vulnerability affects the HappySeaFox SAIL library (cpe:2.3:a:happyseafox:sail) prior to commit 36aa5c7.

RemediationAI

Update SAIL library to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 or later (patch details at https://github.com/HappySeaFox/sail/commit/36aa5c7ec8a2bb35f6fb867a1177a6f141156b02). The patch reconciles pixel format handling by ensuring byte-swap operations respect the buffer allocation size determined by pixmap_depth rather than blindly trusting bits_per_pixel from file headers. For environments unable to immediately update, disable XWD format support in SAIL's codec configuration if the application does not require XWD file processing - this eliminates the attack surface entirely without affecting other supported formats (JPEG, PNG, TIFF, etc.). If XWD support is required, implement input validation rejecting files where bits_per_pixel exceeds pixmap_depth by more than expected alignment padding (typically bits_per_pixel should equal or minimally exceed pixmap_depth for valid files). Deploy SAIL in sandboxed processes with restricted memory permissions to limit exploitation impact, though this adds operational complexity and performance overhead. Monitor for abnormal memory access patterns during image parsing as a detective control.