Is CVE-2026-54626 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54626 being exploited in the wild.

How severe is CVE-2026-54626?

Critical severity, with a CVSS score of 9.8, published 17 September 2026.

Which products and versions are affected?

HappySeaFox SAIL 0.9.10 and earlier.

Is there a fix for CVE-2026-54626?

A patch was published on 2026-06-19: Fixed in version 1.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54626 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54626?

Check whether you run HappySeaFox SAIL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54626: SAIL heap buffer overflow in TGA decoder

CVE-2026-54626 · Severity: critical · CVSS 9.8 · Published 2026-09-17

SAIL is a cross-platform image loading library used by applications to read and write image files. A flaw in its TGA image format parser allows an attacker to craft a malicious image file that, when loaded by an application, can corrupt memory on the heap, crash the application, or potentially execute arbitrary code. This could affect any application using SAIL to open untrusted TGA image files.

Technologies: HappySeaFox SAIL. Vendors: HappySeaFox.

Quick answers

Is CVE-2026-54626 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54626 being exploited in the wild.
How severe is CVE-2026-54626?: Critical severity, with a CVSS score of 9.8, published 17 September 2026.
Which products and versions are affected?: HappySeaFox SAIL 0.9.10 and earlier.
Is there a fix for CVE-2026-54626?: A patch was published on 2026-06-19: Fixed in version 1.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54626 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54626?: Check whether you run HappySeaFox SAIL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap buffer overflow in the TGA codec's handling of run-length-encoded indexed color images. The vulnerable code allocates a one-byte-per-pixel buffer (SAIL_PIXEL_FORMAT_BPP8_INDEXED) based on a fixed format, but then derives the pixel write size from an attacker-controlled bytes-per-pixel (bpp) value from the TGA file header (9–32 bytes), causing writes that exceed the allocated buffer bounds. A prior incomplete fix for CVE-2026-40494 added pixel-count clamping but did not constrain per-pixel write width. An attacker can exploit this by crafting a color-mapped RLE TGA image and loading it via sail_load_from_file() or sail_load_from_memory() without any special privileges. The flaw is fixed in SAIL version 1.0.0 by validating that the file's reported bpp matches the resolved bpp.

Affected products

HappySeaFox SAIL 0.9.10 and earlier

Timeline

2026-09-17: disclosed
2026-06-19: patched: Fixed in version 1.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.