CVE-2026-40492: SAIL has heap buffer overflow in XWD decoder — bits_per_pixel vs pixmap_depth type confusion in byte-swap
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, the XWD codec resolves pixel format based on pixmapdepth but the byte-swap code uses bitsperpixel independently. When pixmapdepth=8 (BPP8INDEXED, 1 byte/pixel buffer) but bitsperpixel=32, the byte-swap loop accesses memory as uint32t, reading/writing 4x the allocated buffer size. This is a different vulnerability from the previously reported GHSA-3g38-x2pj-mv55 (CVE-2026-27168), which addressed bytesperline validation. Commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40492?
CVE-2026-40492 is a critical vulnerability due to a heap buffer overflow in the XWD decoder.
How do I fix CVE-2026-40492?
To fix CVE-2026-40492, you should update SAIL to a version including commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 or later.
What vulnerability type is CVE-2026-40492 characterized as?
CVE-2026-40492 is characterized as a heap buffer overflow vulnerability.
What versions of SAIL are affected by CVE-2026-40492?
SAIL versions prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 are affected by CVE-2026-40492.
Is CVE-2026-40492 specific to any particular file format?
Yes, CVE-2026-40492 specifically affects the XWD codec in SAIL.