CVE-2026-40493 SAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit mode
A heap buffer overflow in the SAIL image library's PSD decoder allows attackers to execute arbitrary code or cause denial of service via crafted images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40493?
CVE-2026-40493 is a critical memory corruption vulnerability in HappySeaFox sail, published on 18 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, the PSD codec computes bytes-per-pixel (`bpp`) from raw header fields `channels * depth`, but the pixel buffer is allocated based on the resolved pixel format. For LAB mode with `channels=3, depth=16`, `bpp = (3*16+7)/8 = 6`, but the format `BPP40_CIE_LAB` allocates only 5 bytes per pixel. Every pixel write overshoots, causing a deterministic heap buffer overflow on every row. Commit c930284445ea3ff94451ccd7a57c999eca3bc979 contains a patch.
Weakness: CWE-787
Which versions are affected by CVE-2026-40493?
How do I fix CVE-2026-40493?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-40493 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40493 exists.
Sources
Also known as DEBIAN-CVE-2026-40493, GHSA-rcqx-gc76-r9mv, UBUNTU-CVE-2026-40493.