Is CVE-2026-54692 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54692 being exploited in the wild.

How severe is CVE-2026-54692?

High severity, with a CVSS score of 7.8, published 17 September 2026.

Which products and versions are affected?

HappySeaFox SAIL prior to 1.0.0.

Is there a fix for CVE-2026-54692?

A patch was published on 2026-06-08: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54692 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-54692?

Check whether you run HappySeaFox SAIL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54692: SAIL library heap overflow in XBM decoder

CVE-2026-54692 · Severity: high · CVSS 7.8 · Published 2026-09-17

SAIL is a cross-platform image processing library used to load and save image files in various formats including XBM (X bitmap). A flaw in the XBM decoder allows attackers to craft malicious XBM image files that, when loaded by an application using SAIL, cause data to be written past the allocated buffer boundary. This memory corruption can crash the application or potentially allow an attacker to execute arbitrary code.

Technologies: HappySeaFox SAIL. Vendors: HappySeaFox.

Quick answers

Is CVE-2026-54692 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54692 being exploited in the wild.
How severe is CVE-2026-54692?: High severity, with a CVSS score of 7.8, published 17 September 2026.
Which products and versions are affected?: HappySeaFox SAIL prior to 1.0.0.
Is there a fix for CVE-2026-54692?: A patch was published on 2026-06-08: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54692 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-54692?: Check whether you run HappySeaFox SAIL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the sail_codec_load_frame_v8_xbm() function in src/sail-codecs/xbm/xbm.c. The XBM decoder allocates a pixel buffer assuming X11 one-byte-per-literal layout but incorrectly processes X10 format static short files where the decoder writes two file-controlled bytes per literal. When the row stride calculation (ceil(width/8)) produces an odd value, X10 files include padding bytes for each row that are not accounted for in the destination buffer allocation, resulting in a forward heap buffer overflow that scales with image height. The vulnerability is triggered when loading XBM files via sail_load_from_file(), sail_load_from_memory(), or sail_start_loading_* functions. The X11 static char path is not affected. An attacker can provide a malicious XBM file to corrupt process memory, trigger reliable crashes, or potentially achieve code execution in consuming applications. The issue is fixed in version 1.0.0.

Affected products

HappySeaFox SAIL prior to 1.0.0

Timeline

2026-09-17: disclosed: CVE-2026-54692 published
2026-06-08: patched: Fix committed to repository
2026-06-19: other: Version 1.0.0 released with patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.