CVE-2026-54626

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54626
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54626.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54626
Aliases
  • GHSA-744p-cqg2-m33h
Downstream
Published
2026-09-17T19:46:20Z
Modified
2026-09-19T08:08:54Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)
Details

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_RLE path selected by image_type == 9 allocates an image buffer using the one-byte-per-pixel SAIL_PIXEL_FORMAT_BPP8_INDEXED format returned by tga_private_sail_pixel_format() in src/sail-codecs/tga/helpers.c, while sail_codec_load_frame_v8_tga() in src/sail-codecs/tga/tga.c derives a two-to-four-byte pixel_size from an attacker-controlled header bpp value from 9 through 32. Loading a crafted color-mapped run-length-encoded TGA through sail_load_from_file() or sail_load_from_memory() therefore writes attacker-controlled bytes beyond the heap pixel buffer. The pixel-count clamp added for CVE-2026-40494 does not constrain the per-pixel write width, so this issue is an incomplete fix of that vulnerability and can cause heap corruption, a reliable crash, or potential code execution. This issue is fixed in version 1.0.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122",
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54626.json"
}
References

Affected packages

Git / github.com/happyseafox/sail

Affected ranges

Type
GIT
Repo
https://github.com/happyseafox/sail
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fa24bceb93958ad665dbc3cf6b49a1079ab12559
Fixed
0f969168b9d19d43f448d2237990ec247ba822ca
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.9.0
v0.9.0-pre1
v0.9.0-pre10
v0.9.0-pre11
v0.9.0-pre12
v0.9.0-pre13
v0.9.0-pre14
v0.9.0-pre15
v0.9.0-pre16
v0.9.0-pre17
v0.9.0-pre18
v0.9.0-pre19
v0.9.0-pre2
v0.9.0-pre20
v0.9.0-pre21
v0.9.0-pre22
v0.9.0-pre23
v0.9.0-pre3
v0.9.0-pre4
v0.9.0-pre5
v0.9.0-pre6
v0.9.0-pre7
v0.9.0-pre8
v0.9.0-pre9
v0.9.0-rc1
v0.9.0-rc2
v0.9.0-rc3
v0.9.1
v0.9.10
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54626.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "203081060056453625017446840195078655746",
                "264907075748600123088187908741055249168",
                "152317054325265890493347908509331727047",
                "305408812690371716271496818391789979575",
                "63313665693018534944434585365639026507",
                "267906469712749720277673461660378578525",
                "66006068939370365507982308022438546234",
                "7750929066271793230710168362400721345",
                "99908915894153185048523501736454179769",
                "214296349349766734680929589307104631608",
                "56786190183046133644548343278590173598",
                "233271309863654722825049277415350613677",
                "220986631308032072739714000990552795184"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54626-101732cb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/fa24bceb93958ad665dbc3cf6b49a1079ab12559",
        "target": {
            "file": "src/sail-codecs/tga/tga.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "23098556256397714419309470804531239173",
            "length": 1764
        },
        "id": "CVE-2026-54626-dab1d008",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/fa24bceb93958ad665dbc3cf6b49a1079ab12559",
        "target": {
            "file": "src/sail-codecs/tga/tga.c",
            "function": "sail_codec_load_frame_v8_tga"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "137443661568885238566133449062019428993",
            "length": 2932
        },
        "id": "CVE-2026-54626-ec27a7bd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/fa24bceb93958ad665dbc3cf6b49a1079ab12559",
        "target": {
            "file": "src/sail-codecs/tga/tga.c",
            "function": "sail_codec_load_seek_next_frame_v8_tga"
        }
    }
]
vanir_signatures_modified 
"2026-09-19T08:08:54Z"