CVE Intelligence
Analysis AI-assisted

CVE-2026-40492: SAIL XWD Codec Out-of-Bounds Write

The XWD image codec in the SAIL library can write outside its allocated buffer because its byte-swap routine uses a pixel-depth field that disagrees with the format selected elsewhere. GitHub's CNA rates it critical with a CVSS 3.1 score of 9.8, and the record points to a patch commit. The record does not list it as exploited, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SAIL is a cross-platform library for loading and saving images. This record describes an out-of-bounds write in its XWD codec. The pixel format is selected from one field, while the byte-swap routine relies on another field, so the two can disagree when a crafted file is processed.

Impact

  • The weakness is classified as CWE-787, Out-of-bounds Write.
  • GitHub's CNA assigns a CVSS 3.1 base score of 9.8 (critical), with a network attack vector, low complexity, no privileges and no user interaction required.
  • The vector reports high impact on confidentiality, integrity and availability. Writes beyond the allocated buffer can corrupt process memory, which may lead to crashes or other harmful effects depending on the application.

Affected products and versions

  • The record lists the affected product as SAIL, but provides no affected version range.
  • The record gives a commit, 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, as the change that fixes the issue. Any release that includes this commit is expected to contain the fix, but the record does not name a fixed release.
  • The advisory and the record should be checked to determine which versions are affected before deciding on an upgrade path.

Exploitation status

  • The CISA KEV catalog does not list this CVE.
  • No confirmed exploitation in the wild appears in the sources consulted for this analysis.
  • EPSS data in the record shows a probability of 0.00553 and a percentile of 0.44702.

Remediation and mitigation

  • Update SAIL to a version that includes commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, after confirming the fixed release in the GitHub advisory.
  • If an immediate update is not possible, limit processing of XWD files from untrusted sources and consider running image decoding in an isolated process or sandbox.
  • Rebuild and redeploy any downstream applications that statically include the library.

Detection guidance

  • Review applications that use SAIL for crashes, memory-corruption errors or sanitizer reports when handling XWD images.
  • Log and review the origin of XWD inputs in workflows that accept images from external users.
  • Track the GitHub advisory for updates to affected versions and fixed releases.

Limitations of the available information

  • The record has no title, and its affected and fixed product lists are empty.
  • The record's source status is Deferred, so the CNA analysis may still change.
  • No affected version range or fixed release tag is available in the sources provided.
  • The relationship to GHSA-3g38-x2pj-mv55 (CVE-2026-27168) is stated as a separate issue, but its details are not included here.

Frequently asked questions

What is CVE-2026-40492?

It is an out-of-bounds write in the XWD image codec of the SAIL library, caused by a mismatch between two pixel-depth fields during byte swapping.

How severe is it?

GitHub's CNA assigns a CVSS 3.1 base score of 9.8, which is critical, with network attack vector and no user interaction required.

Is it being exploited?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

How can I fix it?

Update SAIL to a release that includes commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, after confirming the fixed version in the GitHub advisory.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.