CVE-2026-27168: SAIL: Heap-based Buffer Overflow in Sail-codecs-xwd
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. All versions are vulnerable to Heap-based Buffer Overflow through the XWD parser's use of the bytesperline value. The value os read directly from the file as the read size in io->strictread(), and is never compared to the actual size of the destination buffer. An attacker can provide an XWD file with an arbitrarily large bytesperline, causing a massive write operation beyond the buffer heap allocated for the image pixels. The issue did not have a fix at the time of publication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27168?
CVE-2026-27168 is classified as a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-27168?
To fix CVE-2026-27168, update the Sail library to the latest version that addresses this buffer overflow vulnerability.
What are the potential impacts of CVE-2026-27168?
The impacts of CVE-2026-27168 may include unauthorized access or execution of arbitrary code, leading to system compromise.
Which versions of Sail are affected by CVE-2026-27168?
All versions of the SAIL library are affected by CVE-2026-27168, and immediate action is required.
How can I mitigate risks associated with CVE-2026-27168?
To mitigate risks associated with CVE-2026-27168, avoid using vulnerable versions of the SAIL library until a patched version is implemented.