CVE-2026-40494

{
  "id": "CVE-2026-40494",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-18T03:16:13.590",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302, the TGA codec's RLE decoder in `tga.c` has an asymmetric bounds check vulnerability. The run-packet path (line 297) correctly clamps the repeat count to the remaining buffer space, but the raw-packet path (line 305-311) has no equivalent bounds check. This allows writing up to 496 bytes of attacker-controlled data past the end of a heap buffer. Commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 patches the issue."
    },
    {
      "lang": "es",
      "value": "SAIL es una biblioteca multiplataforma para cargar y guardar imágenes con soporte para animación, metadatos y perfiles ICC. Antes del commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302, el decodificador RLE del códec TGA en ’tga.c’ tiene una vulnerabilidad de verificación de límites asimétrica. La ruta del paquete de ejecución (línea 297) limita correctamente el recuento de repeticiones al espacio restante del búfer, pero la ruta del paquete sin procesar (línea 305-311) no tiene una verificación de límites equivalente. Esto permite escribir hasta 496 bytes de datos controlados por el atacante más allá del final de un búfer de pila. El commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "HappySeaFox",
          "product": "sail",
          "versions": [
            {
              "version": "< 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T14:47:38.934644Z",
          "id": "CVE-2026-40494",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/HappySeaFox/sail/commit/45d48d1f2e8e0d73e80bc1fd5310cb57f4547302",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/HappySeaFox/sail/security/advisories/GHSA-cp2j-rwh4-r46f",
      "source": "[email protected]"
    }
  ]
}