Heap-based Buffer Overflow in SAIL Image Library by HappySeaFox

CVE-2026-27168

What is CVE-2026-27168?

The SAIL image library, developed by HappySeaFox, is susceptible to a heap-based buffer overflow exploit due to improper handling of the 'bytes_per_line' value in its XWD parser. This vulnerability arises when the bytes_per_line value is read directly from the input file within the io->strict_read() function without proper validation against the size of the destination buffer. An attacker can exploit this by crafting an XWD file containing an excessively large bytes_per_line value, leading to a buffer overflow and potentially executing arbitrary code. As of the last update, there was no fix available for this issue, leaving all versions of the SAIL library vulnerable.

References