CVE-2026-54626: SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGAINDEXEDRLE path selected by imagetype == 9 allocates an image buffer using the one-byte-per-pixel SAILPIXELFORMATBPP8INDEXED format returned by tgaprivatesailpixelformat() in src/sail-codecs/tga/helpers.c, while sailcodecloadframev8tga() in src/sail-codecs/tga/tga.c derives a two-to-four-byte pixelsize from an attacker-controlled header bpp value from 9 through 32. Loading a crafted color-mapped run-length-encoded TGA through sailloadfromfile() or sailloadfrommemory() therefore writes attacker-controlled bytes beyond the heap pixel buffer. The pixel-count clamp added for CVE-2026-40494 does not constrain the per-pixel write width, so this issue is an incomplete fix of that vulnerability and can cause heap corruption, a reliable crash, or potential code execution. This issue is fixed in version 1.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SAIL TGA decoderto a version that resolves this vulnerability.Fixed in 1.0.0
Event History
Frequently Asked Questions
Which deployments are affected?
SAIL version 0.9.10 and earlier are affected. The issue is fixed in version 1.0.0.
What must an attacker provide to trigger the issue?
An attacker needs to cause the application to load a crafted color-mapped run-length-encoded TGA image, using either sail_load_from_file() or sail_load_from_memory(). The crafted header uses image_type 9 and an attacker-controlled bpp value from 9 through 32.
Does the earlier pixel-count validation address this issue?
No. The pixel-count clamp added for CVE-2026-40494 does not limit the per-pixel write width, so it does not prevent this heap buffer overflow.