CVE catalog
CVE-2026-54626
DEBIAN-CVE-2026-54626
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.78% · Oct 25, 2026
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_RLE path selected by image_type == 9 allocates an image buffer using the one-byte-per-pixel SAIL_PIXEL_FORMAT_BPP8_INDEXED format returned by tga_private_sail_pixel_format() in src/sail-codecs/tga/helpers.c, while sail_codec_load_frame_v8_tga() in src/sail-codecs/tga/tga.c derives a two-to-four-byte pixel_size from an attacker-controlled header bpp value from 9 through 32. Loading a crafted color-mapped run-length-encoded TGA through sail_load_from_file() or sail_load_from_memory() therefore writes attacker-controlled bytes beyond the heap pixel buffer. The pixel-count clamp added for CVE-2026-40494 does not constrain the per-pixel write width, so this issue is an incomplete fix of that vulnerability and can cause heap corruption, a reliable crash, or potential code execution. This issue is fixed in version 1.0.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | sail | 13 | 0.9.10-1 | vulnerable |
| Debian | sail | 13 | 0.9.10-2 | vulnerable |
| Debian | sail | 13 | 0.9.10-3 | vulnerable |
| Debian | sail | 13 | 0.9.8-1 | vulnerable |
| Debian | sail | 13 | 0.9.8-1+deb13u1 | vulnerable |
| Debian | sail | 13 | 0.9.9-1 | vulnerable |
| Debian | sail | 13 | 1.2.0-1 | vulnerable |
| Debian | sail | 14 | 0.9.10-1 | vulnerable |
| Debian | sail | 14 | 0.9.10-2 | vulnerable |
| Debian | sail | 14 | 0.9.10-3 | vulnerable |
| Debian | sail | 14 | 0.9.8-1 | vulnerable |
| Debian | sail | 14 | 0.9.9-1 | vulnerable |
| Debian | sail | 14 | 1.2.0-1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | sail | deb | 14 | 1.2.0-1 | Not reported | DEBIAN-CVE-2026-54626 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [libsail0t64]Affected
Source package: [sail]
Details (2)
0.9.8-1+deb13u1· amd64 · trixieAffected
pypi · sail · debian · 13
0.9.8-1+deb13u1· arm64 · trixieAffected
pypi · sail · debian · 13
- [libsail-c++0t64]Affected
Source package: [sail]
Details (2)
0.9.8-1+deb13u1· amd64 · trixieAffected
pypi · sail · debian · 13
0.9.8-1+deb13u1· arm64 · trixieAffected
pypi · sail · debian · 13
- [libsail-c++-dev]Affected
Source package: [sail]
Details (2)
0.9.8-1+deb13u1· amd64 · trixieAffected
pypi · sail · debian · 13
0.9.8-1+deb13u1· arm64 · trixieAffected
pypi · sail · debian · 13
- [libsail-common0t64]Affected
Source package: [sail]
Details (2)
0.9.8-1+deb13u1· amd64 · trixieAffected
pypi · sail · debian · 13
0.9.8-1+deb13u1· arm64 · trixieAffected
pypi · sail · debian · 13
- [libsail-common-dev]Affected
Source package: [sail]
Details (2)
0.9.8-1+deb13u1· amd64 · trixieAffected
pypi · sail · debian · 13
0.9.8-1+deb13u1· arm64 · trixieAffected
pypi · sail · debian · 13
- [libsail-dev]Affected
Source package: [sail]
Details (2)
0.9.8-1+deb13u1· amd64 · trixieAffected
pypi · sail · debian · 13
0.9.8-1+deb13u1· arm64 · trixieAffected
pypi · sail · debian · 13
- [libsail-manip0t64]Affected
Source package: [sail]
Details (2)
0.9.8-1+deb13u1· amd64 · trixieAffected
pypi · sail · debian · 13
0.9.8-1+deb13u1· arm64 · trixieAffected
pypi · sail · debian · 13
- [libsail-manip-dev]Affected
Source package: [sail]
Details (2)
0.9.8-1+deb13u1· amd64 · trixieAffected
pypi · sail · debian · 13
0.9.8-1+deb13u1· arm64 · trixieAffected
pypi · sail · debian · 13
- [sail-codecs]Affected
Source package: [sail]
Details (2)
0.9.8-1+deb13u1· amd64 · trixieAffected
pypi · sail · debian · 13
0.9.8-1+deb13u1· arm64 · trixieAffected
pypi · sail · debian · 13
Observed: