# CVE-2026-59959: SAIL WebP decoder divide-by-zero in canvas metadata handling

Source: https://junglewise.ai/threats/cve-2026-59959-sail-is-a-cross-platform-library-for-loading-and-saving-images  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-59959 · Severity: info · Published 2026-10-28

SAIL is a cross-platform library for loading and saving images with animation and metadata support. A malformed animated WebP file can crash SAIL during image loading when it reports a zero canvas width to the decoder, causing a division-by-zero fault that terminates the process. Applications using SAIL to process untrusted WebP images are vulnerable to denial of service.

Technologies: [HappySeaFox SAIL](https://junglewise.ai/threats/technologies/sail). Vendors: [HappySeaFox](https://junglewise.ai/threats/vendors/happyseafox).

## Quick answers

**Is CVE-2026-59959 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59959 being exploited in the wild.

**How severe is CVE-2026-59959?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** HappySeaFox SAIL prior to 1.0.2.

**Is there a fix for CVE-2026-59959?** Yes: fixed in 1.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59959 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59959?** Check whether you run HappySeaFox SAIL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.0.2

## Technical details

The WebP decoder in sail_codec_load_init_v8_webp() retrieves canvas dimensions from the WebP demuxer and immediately divides bytes_per_line by image width to calculate bytes_per_pixel, without validating that width is non-zero. Malformed animated WebP files with inconsistent container metadata can cause WebPDemuxGetI to return zero for WEBP_FF_CANVAS_WIDTH, triggering arithmetic fault before generic skeleton validation occurs. An attacker supplying a crafted WebP file to an application that uses SAIL's WebP decoder can crash that application.

## Affected products

- HappySeaFox SAIL prior to 1.0.2

## Timeline

- 2026-10-28: disclosed

## References

- [https://github.com/HappySeaFox/sail/commit/495660135a4c62e416a1b357a4381dd30069229d](https://github.com/HappySeaFox/sail/commit/495660135a4c62e416a1b357a4381dd30069229d)
- [https://github.com/HappySeaFox/sail/security/advisories/GHSA-5g8g-g347-84m8](https://github.com/HappySeaFox/sail/security/advisories/GHSA-5g8g-g347-84m8)

## Related threats

- [SAIL library heap overflow in XBM decoder](https://junglewise.ai/threats/cve-2026-54692-sail-library-heap-overflow-in-xbm-decoder)
- [SAIL image library heap buffer overflow in PSD bitmap mode](https://junglewise.ai/threats/cve-2026-54627-sail-image-library-heap-buffer-overflow-in-psd-bitmap-mode)
- [SAIL heap buffer overflow in TGA decoder](https://junglewise.ai/threats/cve-2026-54626-sail-heap-buffer-overflow-in-tga-decoder)