What is the CVSS score of CVE-2026-40493?

CVE-2026-40493 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sail are affected by CVE-2026-40493?

SAIL image processing library versions prior to commit c930284 contain a critical remote code execution vulnerability in PSD file handling that allows unauthenticated attackers to execute arbitrary…

How to fix or mitigate CVE-2026-40493?

Within 24 hours: Identify all systems and applications using SAIL library and document current versions; restrict PSD file uploads or processing from untrusted sources. Within 7 days: Update SAIL to commit c930284445ea3ff94451ccd7a57c999eca3bc979 or later; verify the update in development and staging environments. Within 30 days: Complete production deployment across all affected systems; implement input validation to reject LAB-mode PSD files if immediate patching is impossible; conduct application log review for exploitation attempts.

Sail CVE-2026-40493

EUVD-2026-23646 CRITICAL

Out-of-bounds Write (CWE-787)

2026-04-18 GitHub_M

Memory Corruption Buffer Overflow Sail

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 18, 2026 - 03:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 18, 2026 - 03:22 vuln.today

cvss_changed

Analysis Generated

Apr 18, 2026 - 02:41 vuln.today

EUVD ID Assigned

Apr 18, 2026 - 02:30 euvd

EUVD-2026-23646

Analysis Generated

Apr 18, 2026 - 02:30 vuln.today

CVE Published

Apr 18, 2026 - 01:41 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, the PSD codec computes bytes-per-pixel (bpp) from raw header fields channels * depth, but the pixel buffer is allocated based on the resolved pixel format. For LAB mode with channels=3, depth=16, bpp = (3*16+7)/8 = 6, but the format BPP40_CIE_LAB allocates only 5 bytes per pixel. Every pixel write overshoots, causing a deterministic heap buffer overflow on every row. Commit c930284445ea3ff94451ccd7a57c999eca3bc979 contains a patch.

AnalysisAI

Heap buffer overflow in SAIL PSD codec allows remote code execution when processing malicious LAB-mode PSD files. Affects all SAIL versions prior to commit c930284 (HappySeaFox/sail). Attackers can achieve arbitrary code execution (CVSS 9.8: AV:N/AC:L/PR:N/UI:N) by triggering a mismatch between computed bytes-per-pixel (6 bytes for 3-channel 16-bit LAB) and allocated buffer size (5 bytes for BPP40_CIE_LAB format). Every pixel write deterministically overflows the heap buffer. EPSS data not available. Not listed in CISA KEV. Patch available via GitHub commit c930284445ea3ff94451ccd7a57c999eca3bc979.

Technical ContextAI

SAIL (HappySeaFox/sail) is a cross-platform image codec library supporting formats including Adobe PSD with ICC profiles and metadata. The vulnerability (CWE-787: Out-of-bounds Write) occurs in the PSD decoder's pixel buffer allocation logic. The codec calculates bytes-per-pixel as (channels * depth + 7) / 8 from raw PSD header fields, but allocates memory based on an internally-resolved pixel format enum. For LAB colorspace images with 3 channels at 16-bit depth, the calculation yields 6 bytes per pixel, while the BPP40_CIE_LAB format enum allocates only 5 bytes per pixel (40 bits). This one-byte-per-pixel discrepancy causes every pixel write operation to overflow the heap buffer boundary. The overflow is deterministic and occurs on every row during decode, making exploitation reliable. CPE identifies the affected product as cpe:2.3:a:happyseafox:sail:*:*:*:*:*:*:*:*.

RemediationAI

Update SAIL to commit c930284445ea3ff94451ccd7a57c999eca3bc979 or later, available at https://github.com/HappySeaFox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979. The patch corrects the bytes-per-pixel calculation to align with actual allocated buffer sizes for LAB-mode pixel formats. If immediate patching is not feasible, disable PSD format support in SAIL configuration to eliminate the attack surface - this breaks PSD file processing but prevents exploitation. Alternatively, implement strict input validation to reject PSD files with LAB colorspace (check colormode field in PSD header equals 9) before passing to SAIL - this blocks only the vulnerable path while preserving RGB/CMYK PSD support, but requires application-layer changes and understanding of PSD structure. For network-facing services, deploy content-type filtering to reject application/x-photoshop MIME types at ingress - reduces attack surface but may impact legitimate workflows requiring PSD processing. All workarounds have operational trade-offs; vendor patch is the definitive solution.