Executive brief
SAIL is a cross-platform library that loads and saves image files including support for animation and metadata. A vulnerability in PSD (Photoshop) file parsing allows an attacker to craft a malicious PSD file that, when loaded by an application using SAIL, causes a heap buffer overflow due to a mismatch between the declared image color mode and bit depth. This can lead to application crashes or potentially arbitrary code execution.
Technical details
The vulnerability exists in SAIL 0.9.10 and earlier in the PSD codec. The function psd_private_sail_pixel_format() incorrectly resolves a one-channel PSD in Bitmap color mode to SAIL_PIXEL_FORMAT_BPP1_INDEXED without validating that the file depth matches the expected one-bit-per-pixel format. Meanwhile, sail_codec_load_frame_v8_psd() accepts depth == 8, causing it to write one byte per pixel into a buffer sized for one-bit rows. This mode/depth mismatch leads to out-of-bounds heap writes. The vulnerability is triggered via the public APIs sail_load_from_file() or sail_load_from_memory() when processing a crafted PSD file; no authentication is required and the attack vector is the file itself. The flaw results in heap memory corruption, reliable denial of service, or potential code execution. The issue is resolved in version 1.0.0.
Affected products
- HappySeaFox SAIL 0.9.10 and earlier
Timeline
- 2026-09-17: disclosed
- 2026-06-19: patched: Version 1.0.0 released on June 19, 2026