CVE-2026-40493

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40493
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40493.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40493
Aliases
  • GHSA-rcqx-gc76-r9mv
Downstream
Published
2026-04-18T01:41:14Z
Modified
2026-08-12T16:25:08Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
SAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit mode
Details

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, the PSD codec computes bytes-per-pixel (bpp) from raw header fields channels * depth, but the pixel buffer is allocated based on the resolved pixel format. For LAB mode with channels=3, depth=16, bpp = (3*16+7)/8 = 6, but the format BPP40_CIE_LAB allocates only 5 bytes per pixel. Every pixel write overshoots, causing a deterministic heap buffer overflow on every row. Commit c930284445ea3ff94451ccd7a57c999eca3bc979 contains a patch.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40493.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "c930284445ea3ff94451ccd7a57c999eca3bc979"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/happyseafox/sail

Affected ranges

Type
GIT
Repo
https://github.com/happyseafox/sail
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c930284445ea3ff94451ccd7a57c999eca3bc979
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

v0.*
v0.9.0
v0.9.0-pre1
v0.9.0-pre10
v0.9.0-pre11
v0.9.0-pre12
v0.9.0-pre13
v0.9.0-pre14
v0.9.0-pre15
v0.9.0-pre16
v0.9.0-pre17
v0.9.0-pre18
v0.9.0-pre19
v0.9.0-pre2
v0.9.0-pre20
v0.9.0-pre21
v0.9.0-pre22
v0.9.0-pre23
v0.9.0-pre3
v0.9.0-pre4
v0.9.0-pre5
v0.9.0-pre6
v0.9.0-pre7
v0.9.0-pre8
v0.9.0-pre9
v0.9.0-rc1
v0.9.0-rc2
v0.9.0-rc3
v0.9.1
v0.9.10
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40493.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "213339488548051825290377178804834739632",
            "length": 7660
        },
        "id": "CVE-2026-40493-156f3b1e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "tests/sail-common/integrity.c",
            "function": "test_pixel_format_from_string"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "231517295174002416294839031905979407112",
                "188180142417245101364359122044357338711",
                "273671405147151779947341585015026870030",
                "325216081574044606483837697806917244988",
                "44270675985504891056595006318921493754",
                "259410348878843467580591841215214462636",
                "265976157282689598654773761057330870714",
                "87391180836052322112932037684683124201"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-40493-185f50c7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/sail-common/common_serialize.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "112826098800546256645694396163460563610",
            "length": 2223
        },
        "id": "CVE-2026-40493-2dc229e5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/sail-codecs/psd/helpers.c",
            "function": "psd_private_sail_pixel_format"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "85273400961574362229251136605937141962",
                "306159992232681068361938397638659790825",
                "233896929309656568217589203036784684106",
                "175664774383555655165280480391744536255",
                "232879925567746238270794695061371807109",
                "322856476039653229892553228391913140946",
                "19149862439891180422890815573213126847",
                "98123768473269381629547929700714308053"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-40493-36b85b83",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/sail-common/utils.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "213894483933777405872789639568184302313",
            "length": 4957
        },
        "id": "CVE-2026-40493-3792ca08",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/sail-common/utils.c",
            "function": "sail_bits_per_pixel"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "277234587809936347633470930726602524715",
                "266225510950391491359525667755348501379",
                "256339789207071689629507117105456794889"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-40493-4b37f8c2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "tests/sail-common/bytes_per_line.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "112082788725860704096248710308133786349",
            "length": 18243
        },
        "id": "CVE-2026-40493-4e3849b3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/bindings/sail-python/src/enums_bindings.cpp",
            "function": "init_enums"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "251294111510942054229334125121690870043",
            "length": 8389
        },
        "id": "CVE-2026-40493-528937c8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/sail-common/common_serialize.c",
            "function": "sail_pixel_format_from_string"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "253847532160898436372506940567822017785",
            "length": 405
        },
        "id": "CVE-2026-40493-72d71125",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "tests/sail-common/bytes_per_line.c",
            "function": "test_cie_lab"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "245372989624260089442199684179160566170",
            "length": 4241
        },
        "id": "CVE-2026-40493-753e7e3f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/sail-common/utils.c",
            "function": "sail_pixel_format_channels"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "110259096549599551544936205049730706626",
            "length": 2743
        },
        "id": "CVE-2026-40493-7a5a2ecc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/sail-codecs/psd/psd.c",
            "function": "sail_codec_load_frame_v8_psd"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "81284175399611265385127402134235724063",
            "length": 7437
        },
        "id": "CVE-2026-40493-7fd6cc28",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "tests/sail-common/integrity.c",
            "function": "test_pixel_format_to_string"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "305967067677194111110130658088790466865",
            "length": 6499
        },
        "id": "CVE-2026-40493-8f77e921",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/sail-common/common_serialize.c",
            "function": "sail_pixel_format_to_string"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "145325546552441975844195966247941354470",
                "26639689416253091312251724653478073496",
                "308969595312187959218793755457997602409",
                "79437756706866686041452297236527781219"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-40493-a02b0a46",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/sail-codecs/psd/helpers.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "147623758926394513724419008686686146504",
                "325318748487292559029037745339558333208",
                "241773928407410648384227570585396445023",
                "296371465870833572339541163082501520600"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-40493-bcb2d498",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "tests/sail-common/binary_compatibility.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "80242576731326269003602244027172115750",
            "length": 455
        },
        "id": "CVE-2026-40493-c0794a25",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "tests/sail-common/binary_compatibility.c",
            "function": "test_pixel_format_binary_compatibility"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "124555781669864919256380673008183970067",
                "68073385854072101853472724952446150942",
                "50165605706227335515710470645488008505",
                "322902336340053167466028579449684212632",
                "197710072842476816637687649735978589158",
                "8199322436979542844746362096752609388",
                "73387456529253610294958076581529630709",
                "113682981476445778835270169412391543141"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-40493-c151c2b8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "tests/sail-common/integrity.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "308122467506156429406148210428912853716",
                "57492694922013962194728210409277640294",
                "99608574921558673103258723864086313473",
                "301778236384678103433140198237463840792"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-40493-ebd80d48",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/bindings/sail-python/src/enums_bindings.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "10450314494349027074380514104554945929",
                "155430764995082406420674721471581189392",
                "272140030403766188251477898388761979069",
                "187590772453177003429511917570693641679"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-40493-f05858a3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/sail-common/common.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "53110448219753615983494839089796453308",
                "130905564354785826305889895638736945553",
                "51383484694986972127512256972645760023",
                "22140491340691771817299149485678328230",
                "124621281188859374078635702028064338534",
                "328909623183942163537960092546362988011",
                "6316520774941601292866004109213797697",
                "149232201301362048636893363357378721174",
                "160427061207850229954798368260494212594",
                "156979379138965834871201366087255968488",
                "88764146297906181098851896227213024426",
                "336273057275645613072089167056833534756",
                "74844131709812587782139669152737488429",
                "105873685158823493022955273167693269723",
                "915681945215838803497215877786728420",
                "285840621960238461284428405619971707916",
                "74844131709812587782139669152737488429",
                "339386817315552430026401979046203653741",
                "37171390448484340509186002040952349145",
                "288228954381881425393842133560473615915"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-40493-fccc11c2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979",
        "target": {
            "file": "src/sail-codecs/psd/psd.c"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T16:25:08Z"