What is the CVSS score of CVE-2026-40494?

CVE-2026-40494 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sail are affected by CVE-2026-40494?

SAIL image library versions prior to commit 45d48d1 contain a critical heap buffer overflow in the TGA decoder that enables unauthenticated remote code execution when processing malformed image…. A patch is available.

How to fix or mitigate CVE-2026-40494?

Within 24 hours: Identify all systems and applications using SAIL library versions prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302; isolate or disable TGA file processing on externally-facing services. Within 7 days: Apply vendor patch by updating SAIL to the version containing commit 45d48d1 or later across all affected systems. Within 30 days: Conduct full inventory of SAIL deployments, verify patch deployment completion, and implement file-type validation to restrict TGA processing to trusted sources only.

Sail CVE-2026-40494

EUVD-2026-23648 CRITICAL

Out-of-bounds Write (CWE-787)

2026-04-18 GitHub_M

Buffer Overflow Memory Corruption Sail Happyseafox

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 20, 2026 - 18:55 nvd

Patch available

Analysis Updated

Apr 18, 2026 - 03:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 18, 2026 - 03:22 vuln.today

cvss_changed

Patch available

Apr 18, 2026 - 03:01 EUVD

Analysis Generated

Apr 18, 2026 - 02:41 vuln.today

EUVD ID Assigned

Apr 18, 2026 - 02:30 euvd

EUVD-2026-23648

Analysis Generated

Apr 18, 2026 - 02:30 vuln.today

CVE Published

Apr 18, 2026 - 01:42 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302, the TGA codec's RLE decoder in tga.c has an asymmetric bounds check vulnerability. The run-packet path (line 297) correctly clamps the repeat count to the remaining buffer space, but the raw-packet path (line 305-311) has no equivalent bounds check. This allows writing up to 496 bytes of attacker-controlled data past the end of a heap buffer. Commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 patches the issue.

AnalysisAI

Heap buffer overflow in SAIL image library's TGA decoder allows remote code execution via malformed RLE-compressed TGA files against all versions prior to commit 45d48d1. Network-accessible applications processing untrusted TGA images can be fully compromised without authentication or user interaction (CVSS 9.8). The raw-packet RLE decompression path permits writing up to 496 bytes of attacker-controlled data beyond allocated heap bounds. Vendor patch confirmed via GitHub commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302. No CISA KEV listing or public POC identified at time of analysis, but the straightforward exploitation conditions (parsing untrusted files) and complete technical disclosure create high weaponization risk.

Technical ContextAI

SAIL (cpe:2.3:a:happyseafox:sail) is a cross-platform image codec library supporting format conversion, animation, metadata, and ICC profiles. The vulnerability resides in the TGA (Targa) format codec's run-length encoding (RLE) decompression routine in tga.c. TGA RLE uses two packet types: run-length packets (repeating pixel data) and raw packets (literal pixel data). The decoder correctly bounds-checks run-length packets at line 297 by clamping repeat counts to remaining buffer space, but the raw-packet handler (lines 305-311) lacks equivalent validation. This asymmetric validation creates a classic CWE-787 out-of-bounds write condition where raw-packet sequences can write attacker-controlled pixel data up to 496 bytes past the heap allocation boundary. The 496-byte overrun limit derives from TGA packet structure (maximum 128 pixels per packet × variable bytes-per-pixel), making this a deterministic overflow rather than unbounded corruption.

RemediationAI

Update SAIL library to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 or any subsequent release incorporating this fix (https://github.com/HappySeaFox/sail/commit/45d48d1f2e8e0d73e80bc1fd5310cb57f4547302). Rebuild all dependent applications against patched library version. For environments unable to immediately upgrade, implement defense-in-depth controls: disable TGA format support entirely if not business-critical (eliminates attack surface), enforce strict file type validation before passing to SAIL (reject files with TGA magic bytes 0x00 at offset 0-1), deploy image processing in isolated sandboxes with limited heap executable memory (containers, seccomp filters, or pledged processes reduce RCE impact to denial-of-service). Note that disabling TGA support breaks legitimate TGA file workflows; file type filtering can be bypassed via polyglot files; sandboxing adds operational complexity and may degrade performance for batch processing. Workarounds are interim mitigations only-vendor patch remains the complete remediation.