SAIL Image Library CVE-2026-54692

Exploitation requires the victim to load an attacker-supplied XBM file in the legacy X10 'static short' format (the X11 'static char' path is explicitly NOT affected) through SAIL's sail_load_from_file, sail_load_from_memory, or sail_start_loading_* APIs in a build prior to 1.0.0. The overwrite only triggers when ceil(width/8) yields an odd row stride, which introduces a per-row padding byte the destination buffer lacks. Limiting factors: user interaction is required (the application must be induced to open the crafted image), exploitation is local/file-based (AV:L) not remote, the impact scales with image height, and reliable code execution depends on the memory layout and mitigations of the specific consuming application - absent those, the outcome is a crash rather than RCE.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (base 7.8) is internally consistent with the description: this is a file-parsing memory-safety flaw in SAIL's XBM codec, exploited locally (AV:L) when a victim application loads an attacker-supplied XBM image (UI:R), with no authentication (PR:N). The high C/I/A rating rests on the description's claim that the forward heap overwrite of file-controlled bytes can 'corrupt process state, cause reliable crashes, and potentially enable code execution' - note the word 'potentially': A:H (reliable crash/DoS) is well supported, while C:H/I:H (full code execution) is the optimistic upper bound and is not demonstrated by any published exploit. There is no EPSS score, no CISA KEV listing, and no public POC provided; the 'RCE' tag reflects potential impact, not confirmed exploitation. SSVC-wise: exploitation is 'none' (no public exploit identified), the flaw is technically well-understood (root cause and fix are public in the commit), but weaponization into reliable RCE depends heavily on the consuming application's heap layout and mitigations, making this a real-but-not-urgent priority: a legitimate memory-corruption bug worth patching, but gated behind user interaction and a niche library rather than a mass-exploitable remote CVE.

An attacker crafts a malformed X10-format static short XBM image whose row stride ceil(width/8) is odd, so each row includes a padding byte the destination buffer was never sized for. A victim application built on SAIL loads the file via sail_load_from_file/sail_load_from_memory/sail_start_loading_*, and the decode loop writes two file-controlled bytes per literal into a buffer allocated for one byte per literal, producing a forward heap overwrite that grows with image height. No public exploit code is identified; the practical outcome is a reliable crash, with code execution only potentially achievable in a susceptible host application.