CVE-2026-54627: SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psdprivatesailpixelformat() in src/sail-codecs/psd/helpers.c resolves a one-channel PSD in Bitmap color mode to SAILPIXELFORMATBPP1INDEXED without requiring the file depth to be one, so the pixel buffer uses one-bit rows while sailcodecloadframev8psd() in src/sail-codecs/psd/psd.c accepts depth == 8 and writes one attacker-controlled byte per pixel. Loading a crafted PSD through sailloadfromfile() or sailloadfrommemory() therefore writes beyond each heap row, causing memory corruption, a reliable crash, or potential code execution. This mode/depth mismatch is distinct from GHSA-rcqx-gc76-r9mv and GHSA-wcj8-hxxf-pq2c. This issue is fixed in version 1.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SAILto a version that resolves this vulnerability.Fixed in 1.0.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using SAIL 0.9.10 or earlier are exposed if they load PSD files through sail_load_from_file() or sail_load_from_memory(). The vulnerable path is reached when processing a crafted one-channel PSD in Bitmap color mode with depth 8.
Does exploitation require authentication, user interaction, or a special configuration?
No. The reported vector is network-accessible with low attack complexity, requires no privileges or user interaction, and affects PSD loading; the data does not identify a configuration prerequisite.
What is the impact of successfully loading a malicious PSD?
The decoder writes beyond heap row boundaries, causing memory corruption. This can produce a reliable crash and may allow code execution.
What version should be deployed to remediate the issue?
Upgrade SAIL to version 1.0.0, which fixes this issue. If upgrading cannot happen immediately, avoid loading untrusted PSD files through the affected SAIL APIs.