Sail CVE-2026-40494

Exploitation requires the target application to invoke SAIL's TGA decoding functionality on attacker-supplied file data. Vulnerable code path is triggered when processing TGA files with RLE compression (image type 9, 10, or 11 in TGA header) containing raw-packet sequences. No user interaction required if the application automatically processes uploaded files (CVSS UI:N). No authentication required for network-accessible upload endpoints (CVSS PR:N). Vulnerability affects default SAIL builds with TGA codec enabled-no special compilation flags or non-default configuration needed. Exploitation is limited to scenarios where untrusted TGA files reach the decoder; applications that restrict image processing to trusted sources or validated formats (JPEG/PNG only) are not exposed despite using vulnerable SAIL versions. Attack succeeds against both little-endian and big-endian platforms as TGA format parsing is endian-aware.

CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects accurate real-world risk for applications parsing untrusted TGA files from network sources-web servers processing user uploads, email attachment handlers, or document conversion services. Attack complexity is genuinely low: crafting malformed RLE packets requires only basic understanding of TGA format specification. No EPSS score provided, but exploitation likelihood is high given: (1) complete technical disclosure in GitHub advisory with exact vulnerable lines, (2) deterministic 496-byte overrun simplifies exploit development compared to variable-length overflows, (3) heap corruption with attacker-controlled data enables reliable code execution on modern platforms via heap spray or metadata overwrite techniques. Absence from CISA KEV and no identified POC suggests targeted rather than mass exploitation to date. SSVC decision factors: exploitation status unproven, technical impact total (RCE), automatable via malicious file hosting. Priority depends on deployment context-critical for internet-facing image processors, lower for sandboxed desktop applications with user confirmation dialogs. Key uncertainty: prevalence of SAIL library in production environments not documented in available references.

Attacker hosts a specially crafted TGA file on a web server or embeds it in a document. When a victim application using SAIL processes this file (via user upload to a web application, email attachment preview, or automated document conversion pipeline), the TGA decoder allocates a heap buffer based on image dimensions. The malicious file contains RLE raw-packet sequences designed to write 496 bytes past this buffer, overwriting adjacent heap metadata or function pointers. Attacker gains arbitrary code execution in the context of the processing application, potentially escalating to full system compromise if the service runs with elevated privileges.