CVE-2026-54692: SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write)
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sailcodecloadframev8xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row, but the destination has no space for those bytes, so loading the XBM through sailloadfromfile, sailloadfrommemory, or sailstartloading produces a forward heap overwrite that scales with image height. The X11 static char path is not affected. The overwrite can corrupt process state, cause reliable crashes, and potentially enable code execution in a susceptible consuming application. This issue is fixed in version 1.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SAIL (sail_codec_load_frame_v8_xbm in src/sail-codecs/xbm/xbm.c)to a version that resolves this vulnerability.Fixed in 1.0.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using SAIL versions before 1.0.0 are exposed if they load attacker-controlled XBM images through sail_load_from_file, sail_load_from_memory, or the sail_start_loading_* APIs. The vulnerable input is an X10 static short XBM file with an odd ceil(width/8) row stride; X11 static char XBMs are not affected.
What must an attacker do to trigger the overwrite?
An attacker needs to persuade the application to load a crafted X10-format XBM image. Exploitation requires user interaction according to the supplied vector, such as opening or otherwise processing the malicious image in a consuming application.
What is the recommended remediation?
Upgrade SAIL to version 1.0.0, which fixes the issue. If upgrading cannot happen immediately, avoid loading untrusted XBM files and reject X10 static short XBM inputs, particularly those with odd decoded row strides.