CVE-2026-40492

Received Received - Intake

Buffer Overflow in SAIL XWD Codec Causes Memory Corruption

Publication date: 2026-04-18

Last updated on: 2026-04-20

Assigner: GitHub, Inc.

Description

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, the XWD codec resolves pixel format based on `pixmap_depth` but the byte-swap code uses `bits_per_pixel` independently. When `pixmap_depth=8` (BPP8_INDEXED, 1 byte/pixel buffer) but `bits_per_pixel=32`, the byte-swap loop accesses memory as `uint32_t*`, reading/writing 4x the allocated buffer size. This is a different vulnerability from the previously reported GHSA-3g38-x2pj-mv55 (CVE-2026-27168), which addressed `bytes_per_line` validation. Commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-18

Last Modified

2026-04-20

Generated

2026-07-06

AI Q&A

2026-04-18

EPSS Evaluated

2026-07-05

NVD

CVE-2026-40492

EUVD

EUVD-2026-23644

Affected Vendors & Products

Vendor	Product	Version / Range
happyseaflux	sail	to 1.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the SAIL library, which is used for loading and saving images with support for animation, metadata, and ICC profiles. The issue occurs in the XWD codec where the pixel format is resolved based on `pixmap_depth`, but the byte-swap code uses `bits_per_pixel` independently. Specifically, when `pixmap_depth` is 8 (indicating a 1 byte per pixel buffer) but `bits_per_pixel` is 32, the byte-swap loop incorrectly accesses memory as if it were 4 bytes per pixel. This causes the code to read and write beyond the allocated buffer size, leading to a memory access violation.

Impact Analysis

The vulnerability can lead to out-of-bounds memory access, which may cause crashes, data corruption, or potentially allow an attacker to execute arbitrary code. Given the CVSS score of 9.8, it is a critical issue that can impact confidentiality, integrity, and availability of the affected system.

Mitigation Strategies

To mitigate this vulnerability, update the SAIL library to include the patch introduced in commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, which corrects the byte-swap code to properly handle pixel formats and prevent out-of-bounds memory access.

Hi! I’m here to help you understand CVE-2026-40492. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70