---
id: CVE-2026-54692
title: >-
  SAIL is a cross-platform library for loading and saving images with support
  for animation, metadata, and ICC profiles
summary: >-
  SAIL is a cross-platform library for loading and saving images with support
  for animation, metadata, and ICC profiles. Prior to 1.0.0,
  sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the
  decoded pixel buffer using t…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-131
  - CWE-787
vendor: HappySeaFox
product: sail
affected:
  - sail < 1.0.0
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54692'
references:
  - url: >-
      https://github.com/HappySeaFox/sail/commit/2991e18f806cf038038ee1ef9b08aa5d57480de1
    label: security-advisories@github.com
  - url: 'https://github.com/HappySeaFox/sail/releases/tag/v1.0.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/HappySeaFox/sail/security/advisories/GHSA-gp27-qv2x-55v5
    label: security-advisories@github.com
  - url: >-
      https://github.com/HappySeaFox/sail/security/advisories/GHSA-gp27-qv2x-55v5
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00194
epssPercentile: 0.08101
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-21T21:09:57.030603Z'
ingestedAt: '2026-09-17T20:28:02.774Z'
---

## Overview

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row, but the destination has no space for those bytes, so loading the XBM through sail_load_from_file, sail_load_from_memory, or sail_start_loading_* produces a forward heap overwrite that scales with image height. The X11 static char path is not affected. The overwrite can corrupt process state, cause reliable crashes, and potentially enable code execution in a susceptible consuming application. This issue is fixed in version 1.0.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.