Sail CVE-2026-40493

Requires target application to use SAIL library for image processing AND process untrusted PSD files via SAIL's PSD codec. Specifically requires a PSD file with LAB colorspace (colormode field = 9), 3 channels, and 16-bit depth to trigger the allocation mismatch. Default SAIL configurations include PSD codec support, making all installations vulnerable if they handle PSD files. No authentication required (CVSS PR:N) - attacker needs only the ability to supply a PSD file to the target application. No user interaction required (UI:N) if the application auto-processes images (e.g., server-side thumbnail generation, automated document workflows). Exploitation IS limited by deployment context: applications that do not process PSD files, or process only trusted/internal PSD files, or disable SAIL's PSD codec are not exposed despite running vulnerable SAIL versions.

CVSS 9.8 (Critical) reflects maximum exploitability: network-accessible attack vector, low complexity, no authentication or user interaction required, and complete compromise of confidentiality, integrity, and availability. However, real-world risk depends heavily on deployment context. SAIL is a library - exploitation requires an application that processes untrusted PSD files using the affected SAIL codec. The deterministic nature of the overflow (occurs on every pixel of every row in LAB-mode PSDs) increases exploit reliability but also makes detection straightforward. No EPSS score available to assess actual exploitation likelihood. Not present in CISA KEV, indicating no confirmed active exploitation campaigns. GitHub security advisory confirms the issue but no public POC is referenced. SSVC assessment: exploitation status unknown, likely automatable given deterministic overflow, technical impact is total system compromise if exploited in a privileged service. Priority depends on whether defenders use SAIL in attack-surface-exposed applications (web servers processing user uploads, email attachment parsers, etc.) versus internal tools. The obscurity of LAB-mode PSD files may reduce attacker interest compared to common formats.

Attacker crafts a malicious PSD file with LAB colorspace (colormode=9), 3 channels, and 16-bit depth. When a victim application using SAIL processes this file (e.g., web service generating thumbnails from user uploads, document converter, image gallery software), the PSD decoder allocates a 5-byte-per-pixel buffer but writes 6 bytes per pixel. The deterministic one-byte overflow on every pixel across every row corrupts heap metadata. Attacker controls overflow content via pixel data, enabling heap manipulation to overwrite function pointers or vtable entries, achieving arbitrary code execution with the privileges of the processing application.