Memory Corruption Vulnerability in SAIL Image Processing Library

CVE-2026-54627

What is CVE-2026-54627?

The SAIL image processing library allows for the manipulation of image files, including PSD formats. A flaw exists in versions up to 0.9.10 where the function psd_private_sail_pixel_format() incorrectly processes one-channel PSD files in Bitmap color mode. This issue arises from a mismatch between the expected pixel depth and the actual depth used, leading to improperly sized pixel buffers. When a specially crafted PSD file is loaded, it can result in memory being corrupted—potentially leading to application crashes or unwanted code execution. This vulnerability has been resolved in version 1.0.0.

References