Executive brief
SAIL is a cross-platform image loading library used by applications to read and write image files. A flaw in its TGA image format parser allows an attacker to craft a malicious image file that, when loaded by an application, can corrupt memory on the heap, crash the application, or potentially execute arbitrary code. This could affect any application using SAIL to open untrusted TGA image files.
Technical details
The vulnerability is a heap buffer overflow in the TGA codec's handling of run-length-encoded indexed color images. The vulnerable code allocates a one-byte-per-pixel buffer (SAIL_PIXEL_FORMAT_BPP8_INDEXED) based on a fixed format, but then derives the pixel write size from an attacker-controlled bytes-per-pixel (bpp) value from the TGA file header (9–32 bytes), causing writes that exceed the allocated buffer bounds. A prior incomplete fix for CVE-2026-40494 added pixel-count clamping but did not constrain per-pixel write width. An attacker can exploit this by crafting a color-mapped RLE TGA image and loading it via sail_load_from_file() or sail_load_from_memory() without any special privileges. The flaw is fixed in SAIL version 1.0.0 by validating that the file's reported bpp matches the resolved bpp.
Affected products
- HappySeaFox SAIL 0.9.10 and earlier
Timeline
- 2026-09-17: disclosed
- 2026-06-19: patched: Fixed in version 1.0.0