HappySeaFox Sail up to 0.9.10 TGA Codec tga.c sail_codec_load_frame_v8_tga buffer overflow

Summaryinfo

A vulnerability has been found in HappySeaFox Sail up to 0.9.10 and classified as critical. Affected by this vulnerability is the function sail_codec_load_frame_v8_tga of the file src/sail-codecs/tga/tga.c of the component TGA Codec. This manipulation causes buffer overflow. This vulnerability is handled as CVE-2026-54626. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in HappySeaFox Sail up to 0.9.10 and classified as critical. Affected by this vulnerability is the function sail_codec_load_frame_v8_tga of the file src/sail-codecs/tga/tga.c of the component TGA Codec. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_RLE path selected by image_type == 9 allocates an image buffer using the one-byte-per-pixel SAIL_PIXEL_FORMAT_BPP8_INDEXED format returned by tga_private_sail_pixel_format() in src/sail-codecs/tga/helpers.c, while sail_codec_load_frame_v8_tga() in src/sail-codecs/tga/tga.c derives a two-to-four-byte pixel_size from an attacker-controlled header bpp value from 9 through 32. Loading a crafted color-mapped run-length-encoded TGA through sail_load_from_file() or sail_load_from_memory() therefore writes attacker-controlled bytes beyond the heap pixel buffer. The pixel-count clamp added for CVE-2026-40494 does not constrain the per-pixel write width, so this issue is an incomplete fix of that vulnerability and can cause heap corruption, a reliable crash, or potential code execution. This issue is fixed in version 1.0.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-54626 since 06/15/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.0.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• HappySeaFox

Name

• Sail

Version

• 0.9.0
• 0.9.1
• 0.9.2
• 0.9.3
• 0.9.4
• 0.9.5
• 0.9.6
• 0.9.7
• 0.9.8
• 0.9.9
• 0.9.10

Website

• Product: https://github.com/HappySeaFox/sail/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion