Executive brief
SAIL is a cross-platform image processing library used to load and save image files in various formats including XBM (X bitmap). A flaw in the XBM decoder allows attackers to craft malicious XBM image files that, when loaded by an application using SAIL, cause data to be written past the allocated buffer boundary. This memory corruption can crash the application or potentially allow an attacker to execute arbitrary code.
Technical details
The vulnerability exists in the sail_codec_load_frame_v8_xbm() function in src/sail-codecs/xbm/xbm.c. The XBM decoder allocates a pixel buffer assuming X11 one-byte-per-literal layout but incorrectly processes X10 format static short files where the decoder writes two file-controlled bytes per literal. When the row stride calculation (ceil(width/8)) produces an odd value, X10 files include padding bytes for each row that are not accounted for in the destination buffer allocation, resulting in a forward heap buffer overflow that scales with image height. The vulnerability is triggered when loading XBM files via sail_load_from_file(), sail_load_from_memory(), or sail_start_loading_* functions. The X11 static char path is not affected. An attacker can provide a malicious XBM file to corrupt process memory, trigger reliable crashes, or potentially achieve code execution in consuming applications. The issue is fixed in version 1.0.0.
Affected products
- HappySeaFox SAIL prior to 1.0.0
Timeline
- 2026-09-17: disclosed: CVE-2026-54692 published
- 2026-06-08: patched: Fix committed to repository
- 2026-06-19: other: Version 1.0.0 released with patch