CVE-2026-54627

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54627

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54627.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54627

Aliases

GHSA-ccqf-rv86-h3wm

Downstream

DEBIAN-CVE-2026-54627

Published

2026-09-17T19:47:14Z

Modified

2026-09-20T14:24:45Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)

Details

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psd_private_sail_pixel_format() in src/sail-codecs/psd/helpers.c resolves a one-channel PSD in Bitmap color mode to SAIL_PIXEL_FORMAT_BPP1_INDEXED without requiring the file depth to be one, so the pixel buffer uses one-bit rows while sail_codec_load_frame_v8_psd() in src/sail-codecs/psd/psd.c accepts depth == 8 and writes one attacker-controlled byte per pixel. Loading a crafted PSD through sail_load_from_file() or sail_load_from_memory() therefore writes beyond each heap row, causing memory corruption, a reliable crash, or potential code execution. This mode/depth mismatch is distinct from GHSA-rcqx-gc76-r9mv and GHSA-wcj8-hxxf-pq2c. This issue is fixed in version 1.0.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122",
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54627.json"
}

References

Affected packages

Git / github.com/happyseafox/sail

Affected ranges

Type

GIT

Repo

https://github.com/happyseafox/sail

Events

Introduced

Fixed

f44a8b779a1fc527fc6bc5caa71a66a8ed940d50

Fixed

0f969168b9d19d43f448d2237990ec247ba822ca

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.9.0

v0.9.0-pre1

v0.9.0-pre10

v0.9.0-pre11

v0.9.0-pre12

v0.9.0-pre13

v0.9.0-pre14

v0.9.0-pre15

v0.9.0-pre16

v0.9.0-pre17

v0.9.0-pre18

v0.9.0-pre19

v0.9.0-pre2

v0.9.0-pre20

v0.9.0-pre21

v0.9.0-pre22

v0.9.0-pre23

v0.9.0-pre3

v0.9.0-pre4

v0.9.0-pre5

v0.9.0-pre6

v0.9.0-pre7

v0.9.0-pre8

v0.9.0-pre9

v0.9.0-rc1

v0.9.0-rc2

v0.9.0-rc3

v0.9.1

v0.9.10

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54627.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "307488873974150552025479686249349412894",
                "127199678832599759946853843836746941358",
                "147414825653461588994387792370374557997",
                "82308859115016811109377750850125080791",
                "256359552831175530842056331129732691292",
                "187797151996113435274622902569268012964",
                "21447939997633574384980739021306519502",
                "238076186408965368500256795376196638712"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54627-3527a248",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/f44a8b779a1fc527fc6bc5caa71a66a8ed940d50",
        "target": {
            "file": "src/sail-codecs/psd/helpers.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "23220697465794353663822906301135881333",
            "length": 3458
        },
        "id": "CVE-2026-54627-70896218",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/f44a8b779a1fc527fc6bc5caa71a66a8ed940d50",
        "target": {
            "file": "src/sail-codecs/psd/psd.c",
            "function": "sail_codec_load_seek_next_frame_v8_psd"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "111213252273852031844972792108267058801",
                "35526677185886884715583492032543867966",
                "251809861137730582558173170614930102444",
                "166457703013113967008085044865844303259",
                "213668961056980061564323482716250555001",
                "186619349177762486653887087649295199976",
                "2108508743090319265387679230750402631",
                "155067479174323429152205568157349792626",
                "273332748359020092710987005501688784333"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54627-8095fe3d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/f44a8b779a1fc527fc6bc5caa71a66a8ed940d50",
        "target": {
            "file": "src/sail-codecs/psd/psd.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "215382653890947427923865726994795132696",
            "length": 2223
        },
        "id": "CVE-2026-54627-e752ecb3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/happyseafox/sail/commit/f44a8b779a1fc527fc6bc5caa71a66a8ed940d50",
        "target": {
            "file": "src/sail-codecs/psd/helpers.c",
            "function": "psd_private_sail_pixel_format"
        }
    }
]

vanir_signatures_modified

"2026-09-20T14:24:45Z"