EUVD-2026-82407Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious color-mapped RLE TGA (bpp 9-32)
-
DeliveryDeliver file to victim application
-
ExploitApplication calls sail_load into BPP8_INDEXED buffer
-
ExecutionOversized per-pixel write overflows heap
-
ImpactHeap corruption enables crash or code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target application to load an attacker-supplied TGA image through SAIL's sail_load_from_file() or sail_load_from_memory() using SAIL version 0.9.10 or earlier. The malicious file must be a color-mapped, run-length-encoded TGA (image_type == 9) with a header bpp field set between 9 and 32, so the per-pixel write width (2-4 bytes) exceeds the 1-byte-per-pixel BPP8_INDEXED buffer. LIMITING FACTORS: exploitation depends on user/application interaction to open the crafted file (there is no inherent network-listening service), and the flaw is closed in version 1.0.0 which adds a bpp-vs-resolved-pixel-format consistency check. |
| Impact | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) overstates real-world risk because it omits the user-interaction requirement that a file-parsing library inherently imposes: exploitation requires the victim's application to load an attacker-crafted color-mapped RLE TGA via sail_load_from_file() or sail_load_from_memory(). The technical severity is genuine - the commit diff confirms an attacker-controlled header bpp (9-32) drives a 2-4 byte per-pixel write width into a buffer allocated at 1 byte/pixel (BPP8_INDEXED), yielding an out-of-bounds heap write of attacker-controlled bytes (CWE-122), consistent with the vendor CWE. Notably this is explicitly an INCOMPLETE FIX of CVE-2026-40494: the earlier pixel-count clamp does not constrain per-pixel write width, a meaningful signal that the code path is fragile and has already drawn attacker attention. No EPSS score, no CISA KEV listing, and no public POC are present in the input - so this is 'no public exploit identified at time of analysis,' not confirmed exploitation. Net: a real, patch-worthy heap-corruption bug with plausible RCE potential, but practical risk is gated by the need to trick a target into opening a malicious image, and by the library's modest deployment footprint - not an internet-facing wormable 9.8. |
| Exploit ScenarioDerived | An attacker crafts a color-mapped run-length-encoded TGA (image_type == 9) with a header bpp value between 9 and 32 and delivers it to a target application that uses SAIL to decode images (e.g., via email attachment, chat, or a website thumbnail pipeline). When the victim application calls sail_load_from_file() or sail_load_from_memory(), the mismatch between the 1-byte/pixel indexed allocation and the 2-4 byte per-pixel write corrupts the heap, causing a reliable crash or potential code execution. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Heap-based buffer overflow in the SAIL cross-platform image library version 0.9.10 and earlier allows an attacker who supplies a crafted color-mapped, run-length-encoded TGA file (image_type == 9) to write attacker-controlled bytes past the end of a heap pixel buffer, causing heap corruption, a reliable crash, or potential code execution. The flaw is an incomplete fix for CVE-2026-40494: the earlier pixel-count clamp limits how many pixels are written but never constrains the per-pixel write width, which is derived from an attacker-controlled header bpp value of 9 through 32 (2-4 bytes) while the destination buffer is allocated as one-byte-per-pixel SAIL_PIXEL_FORMAT_BPP8_INDEXED. Although the CVSS vector is AV:N/PR:N, exploitation requires the victim's application to load the malicious image through sail_load_from_file() or sail_load_from_memory(), so a user-interaction condition is inherent; no public exploit code was identified at time of analysis, and the issue is fixed in SAIL 1.0.0. Note that the vendor-published CVSS of 9.8 (UI:N) overstates exploitability relative to the independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
RemediationAI
Upgrade to SAIL 1.0.0, the first release containing the fix, published at https://github.com/HappySeaFox/sail/releases/tag/v1.0.0; the patching commit is https://github.com/HappySeaFox/sail/commit/fa24bceb93958ad665dbc3cf6b49a1079ab12559, which adds a bpp-versus-resolved-pixel-format consistency check in sail_codec_load_seek_next_frame_v8_tga() and derives pixel_size from the resolved pixel format rather than the untrusted header, so downstream consumers should rebuild and relink rather than expecting a configuration toggle to help. Vendor-released patch: 1.0.0. For deployments that cannot immediately upgrade, apply a compensating control at the application boundary: refuse to pass TGA files whose image_type byte is 9 or whose header bpp field is outside the expected set (8, 15, 16, 24, 32) before calling sail_load_from_file() or sail_load_from_memory() - this blocks the vulnerable code path but does not protect callers that already pass untrusted bytes directly, and it will legitimately reject palette-based TGA variants that some workflows need. Where possible, disable or compile out TGA codec support entirely, at the cost of losing TGA loading; alternatively, isolate decoding in a sandboxed worker process with strict memory limits so that heap corruption from a malicious image cannot escalate to code execution in the host application, accepting reduced throughput and added process-management complexity. Because exploitation hinges on the victim application opening a hostile image, treat all untrusted TGA input as hostile until 1.0.0 is deployed, and consult https://github.com/HappySeaFox/sail/security/advisories/GHSA-744p-cqg2-m33h for the authoritative advisory text.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SAIL is a cross-platform C library for loading and saving raster and animated images with metadata and ICC profile support, exposing sail_load_from_file() and sail_load_from_memory() entry points used by host applications rather than listening on a network socket. The vulnerable path is the TGA codec: in src/sail-codecs/tga/helpers.c, tga_private_sail_pixel_format() maps an image_type of 9 (color-mapped RLE) to SAIL_PIXEL_FORMAT_BPP8_INDEXED, so the frame buffer is allocated at one byte per pixel, while sail_codec_load_frame_v8_tga() in src/sail-codecs/tga/tga.c computed pixel_size as (file_header.bpp + 7) / 8 from the untrusted header value. A bpp between 9 and 32 therefore yields a 2-, 3-, or 4-byte stride, and each decoded RLE run writes beyond the 1-byte-per-pixel allocation. The root cause class is CWE-122 (heap-based buffer overflow), specifically a size/format mismatch between allocation and write width; the upstream fix (commit fa24bceb93958ad665dbc3cf6b49a1079ab12559) adds a consistency check in sail_codec_load_seek_next_frame_v8_tga() that rejects images whose header bpp does not equal sail_bits_per_pixel() of the resolved pixel format, and derives pixel_size from the resolved format instead of the raw header field.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
File can be delivered remotely (AV:N) but the victim must load the crafted image (UI:R, unlike vendor's UI:N); attacker-controlled heap write yields plausible full C/I/A impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_RLE path selected by image_type == 9 allocates an image buffer using the one-byte-per-pixel SAIL_PIXEL_FORMAT_BPP8_INDEXED format returned by tga_private_sail_pixel_format() in src/sail-codecs/tga/helpers.c, while sail_codec_load_frame_v8_tga() in src/sail-codecs/tga/tga.c derives a two-to-four-byte pixel_size from an attacker-controlled header bpp value from 9 through 32. Loading a crafted color-mapped run-length-encoded TGA through sail_load_from_file() or sail_load_from_memory() therefore writes attacker-controlled bytes beyond the heap pixel buffer. The pixel-count clamp added for CVE-2026-40494 does not constrain the per-pixel write width, so this issue is an incomplete fix of that vulnerability and can cause heap corruption, a reliable crash, or potential code execution. This issue is fixed in version 1.0.0.
Technical POC Analysis
Heap-based buffer overflow, CWE-122 (advisory also tags CWE-787), in the SAIL TGA decoder.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A critical heap memory-corruption flaw in the SAIL cross-platform image library (versions 0.9.10 and earlier) means any application, service, or device that embeds SAIL can be crashed or potentially taken over with attacker-controlled code simply by processing an untrusted TGA image. Because SAIL is a shared dependency rather than a standalone product, the exposure extends across every downstream consumer that accepts images from users, uploads, email, or the web - often without those teams knowing SAIL is present in their stack. Leadership should care because successful exploitation yields code execution at the privilege of the host application, and the affected library is frequently bundled inside software that is not individually tracked in security inventories, making the true blast radius difficult to bound without deliberate effort.
No vendor-released patch identified at time of analysis per the vulnerability record, though the advisory states the flaw is fixed in SAIL 1.0 - verify and apply that upgrade where possible. Until then: block or quarantine untrusted TGA input (especially image_type == 9 run-length-encoded, color-mapped files) at mail, upload, and web gateways; restrict image-conversion and thumbnail services from processing attacker-supplied files; run any SAIL-loading process with least privilege and in a sandboxed or containerized context; and monitor for heap-corruption crashes as an exploitation indicator.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB