CVE-2026-40493: SAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit mode
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, the PSD codec computes bytes-per-pixel (bpp) from raw header fields channels depth, but the pixel buffer is allocated based on the resolved pixel format. For LAB mode with channels=3, depth=16, bpp = (316+7)/8 = 6, but the format BPP40CIELAB allocates only 5 bytes per pixel. Every pixel write overshoots, causing a deterministic heap buffer overflow on every row. Commit c930284445ea3ff94451ccd7a57c999eca3bc979 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40493?
CVE-2026-40493 has been classified as a high severity vulnerability due to the potential for remote code execution caused by a heap buffer overflow.
How do I fix CVE-2026-40493?
To fix CVE-2026-40493, upgrade SAIL to a version that includes the patch from commit c930284445ea3ff94451ccd7a57c999eca3bc979.
What types of systems are affected by CVE-2026-40493?
CVE-2026-40493 affects all systems using SAIL library versions prior to c930284445ea3ff94451ccd7a57c999eca3bc979.
What is the impact of exploiting CVE-2026-40493?
Exploitation of CVE-2026-40493 may allow an attacker to execute arbitrary code on the affected system, compromising its integrity.
Is there a workaround for CVE-2026-40493?
There is no known workaround for CVE-2026-40493; the only mitigation is to apply the necessary software upgrade.