SAIL image library EUVD-2026-82408

Requires a target application that uses SAIL <=0.9.10 to decode an attacker-supplied PSD image through sail_load_from_file() or sail_load_from_memory(). The specific trigger is a PSD in Bitmap color mode with one channel and file depth == 8 (rather than the expected depth 1), which causes psd_private_sail_pixel_format() to select SAIL_PIXEL_FORMAT_BPP1_INDEXED while the loader writes 8-bit bytes per pixel. Limiting factors: the vulnerable app must actually process attacker-controlled PSD input (effectively user/content interaction), and the byte-per-pixel overflow's escalation to code execution depends on heap layout, making a reliable crash the most dependable outcome. No authentication is required against the library itself.

The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) overstates real-world risk. This is a file-parsing memory-corruption bug in an image-decoding library: exploitation requires the victim application to load an attacker-crafted PSD via sail_load_from_file()/sail_load_from_memory(), which realistically implies attacker-supplied-content interaction (UI:R), so the 'no user interaction' rating is questionable - verify with vendor. The vulnerability is confirmed and well-substantiated: the commit diff (f44a8b7) directly shows the mode/depth validation gap, so the root cause is not in doubt. However, no EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified.' The primitive itself is meaningful: one attacker-controlled byte written past each heap row is a strong corruption primitive, so C:H/I:H/A:H is defensible for the code-execution ceiling, but the description frames outcome primarily as 'memory corruption, a reliable crash, or potential code execution,' meaning a reliable crash (DoS) is the most certain impact and RCE is aspirational and heap-layout dependent. Net: a genuine high-severity library bug worth patching promptly, but the 9.8 with UI:N inflates the practical priority for most deployments.

An attacker crafts a PSD file declaring Bitmap color mode with one channel but depth 8, then delivers it to a target that uses SAIL to decode images (e.g., a thumbnailer, upload processor, or desktop viewer). When the application calls sail_load_from_file() or sail_load_from_memory(), the codec allocates one-bit rows but writes one attacker-controlled byte per pixel, corrupting the heap beyond each row and causing a reliable crash or potentially code execution. No public exploit code is identified at time of analysis, though the fixing commit diff clearly reveals the mismatch.