CVE Intelligence
Analysis AI-assisted

CVE-2026-40494: SAIL TGA Decoder Out-of-Bounds Write

SAIL, a cross-platform image library, has an out-of-bounds write (CWE-787) in the RLE decoder of its TGA codec, where the raw-packet path lacks the bounds check used on the run-packet path. The CNA scores it 9.8 (Critical) under CVSS 3.1, and the record references commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 as the patch. The record contains no affected or fixed version list and no KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SAIL is a cross-platform library for loading and saving images. According to the GitHub Security Advisory, the RLE decoder of its TGA codec has an asymmetric bounds check: the run-packet path clamps the repeat count to the remaining buffer space, while the raw-packet path has no equivalent check.

Impact

The record describes an out-of-bounds write (CWE-787) that can write up to 496 bytes of attacker-controlled data past the end of a heap buffer. The CNA assigns a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network reachability, low complexity, no privileges and no user interaction. Consequences beyond memory corruption are not described in the sources consulted.

Affected products and versions

  • Product: SAIL, TGA codec.
  • Affected range: stated as prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302. The record contains no structured affected or fixed version list.
  • Fixed release numbers are not stated in the available data. The referenced commit is the documented fix.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00553 with percentile 0.44701 as recorded.

Remediation and mitigation

  • Update SAIL to a build that includes commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302, as referenced in the GitHub advisory, and check the advisory for release guidance.
  • Until patched, restrict processing of untrusted TGA files, for example by rejecting them at the ingestion boundary or by decoding in isolated processes with reduced privileges.
  • Inventory applications that embed SAIL, since it may be a dependency of other software.

Detection guidance

  • Identify software builds that bundle SAIL and determine whether they predate the referenced commit.
  • Monitor image-processing services that accept TGA input for crashes or memory-safety errors.
  • Review image uploads that fail decoding in unusual ways.

Limitations of the available information

The record has no affected version list and no fixed release version. The NVD source status is recorded as Deferred. Conditions for exploitation beyond the described write are unknown. This analysis relies only on the record and the referenced URLs.

Frequently asked questions

What is the vulnerability in CVE-2026-40494?

The TGA codec RLE decoder in SAIL lacks a bounds check on the raw-packet path, which can cause an out-of-bounds write of up to 496 bytes past a heap buffer, classified as CWE-787.

Is this CVE known to be actively exploited?

The record shows no KEV listing, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.