CVE-2026-40492 SAIL has heap buffer overflow in XWD decoder — bits_per_pixel vs pixmap_depth type confusion in byte-swap
A heap buffer overflow in the SAIL image library's XWD decoder allows attackers to execute arbitrary code or cause denial of service via crafted images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40492?
CVE-2026-40492 is a critical memory corruption vulnerability in HappySeaFox sail, published on 18 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, the XWD codec resolves pixel format based on `pixmap_depth` but the byte-swap code uses `bits_per_pixel` independently. When `pixmap_depth=8` (BPP8_INDEXED, 1 byte/pixel buffer) but `bits_per_pixel=32`, the byte-swap loop accesses memory as `uint32_t*`, reading/writing 4x the allocated buffer size. This is a different vulnerability from the previously reported GHSA-3g38-x2pj-mv55 (CVE-2026-27168), which addressed `bytes_per_line` validation. Commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 contains a patch.
Weakness: CWE-787
Which versions are affected by CVE-2026-40492?
How do I fix CVE-2026-40492?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-40492 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40492 exists.
Sources
Also known as DEBIAN-CVE-2026-40492, GHSA-526v-vm72-4v64, UBUNTU-CVE-2026-40492.