CVE-2026-40494 SAIL has heap buffer overflow in TGA RLE decoder — raw packet path missing bounds check
A heap buffer overflow in the SAIL image library's TGA RLE decoder allows attackers to execute arbitrary code or cause denial of service via crafted images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40494?
CVE-2026-40494 is a critical memory corruption vulnerability in HappySeaFox sail, published on 18 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302, the TGA codec's RLE decoder in `tga.c` has an asymmetric bounds check vulnerability. The run-packet path (line 297) correctly clamps the repeat count to the remaining buffer space, but the raw-packet path (line 305-311) has no equivalent bounds check. This allows writing up to 496 bytes of attacker-controlled data past the end of a heap buffer. Commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 patches the issue.
Weakness: CWE-787
Which versions are affected by CVE-2026-40494?
How do I fix CVE-2026-40494?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-40494 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40494 exists.
Sources
Also known as DEBIAN-CVE-2026-40494, GHSA-cp2j-rwh4-r46f, UBUNTU-CVE-2026-40494.