{"id":"CVE-2026-40493","summary":"SAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit mode","details":"SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, the PSD codec computes bytes-per-pixel (`bpp`) from raw header fields `channels * depth`, but the pixel buffer is allocated based on the resolved pixel format. For LAB mode with `channels=3, depth=16`, `bpp = (3*16+7)/8 = 6`, but the format `BPP40_CIE_LAB` allocates only 5 bytes per pixel. Every pixel write overshoots, causing a deterministic heap buffer overflow on every row. Commit c930284445ea3ff94451ccd7a57c999eca3bc979 contains a patch.","aliases":["GHSA-rcqx-gc76-r9mv"],"modified":"2026-08-12T16:25:08.927407Z","published":"2026-04-18T01:41:14.664Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40493.json","unresolved_ranges":[{"extracted_events":[{"fixed":"c930284445ea3ff94451ccd7a57c999eca3bc979"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40493.json"},{"type":"ADVISORY","url":"https://github.com/HappySeaFox/sail/security/advisories/GHSA-rcqx-gc76-r9mv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40493"},{"type":"FIX","url":"https://github.com/HappySeaFox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/happyseafox/sail","events":[{"introduced":"0"},{"fixed":"c930284445ea3ff94451ccd7a57c999eca3bc979"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v0.9.10","v0.9.9","v0.9.8","v0.9.7","v0.9.6","v0.9.5","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.9.0-rc3","v0.9.0-rc2","v0.9.0-rc1","v0.9.0-pre23","v0.9.0-pre22","v0.9.0-pre21","v0.9.0-pre20","v0.9.0-pre19","v0.9.0-pre18","v0.9.0-pre17","v0.9.0-pre16","v0.9.0-pre15","v0.9.0-pre14","v0.9.0-pre13","v0.9.0-pre12","v0.9.0-pre11","v0.9.0-pre10","v0.9.0-pre9","v0.9.0-pre8","v0.9.0-pre7","v0.9.0-pre6","v0.9.0-pre5","v0.9.0-pre4","v0.9.0-pre3","v0.9.0-pre2","v0.9.0-pre1"],"database_specific":{"vanir_signatures_modified":"2026-08-12T16:25:08Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"213339488548051825290377178804834739632","length":7660},"id":"CVE-2026-40493-156f3b1e","signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"function":"test_pixel_format_from_string","file":"tests/sail-common/integrity.c"}},{"deprecated":false,"digest":{"line_hashes":["231517295174002416294839031905979407112","188180142417245101364359122044357338711","273671405147151779947341585015026870030","325216081574044606483837697806917244988","44270675985504891056595006318921493754","259410348878843467580591841215214462636","265976157282689598654773761057330870714","87391180836052322112932037684683124201"],"threshold":0.9},"id":"CVE-2026-40493-185f50c7","signature_type":"Line","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"src/sail-common/common_serialize.c"}},{"deprecated":false,"digest":{"function_hash":"112826098800546256645694396163460563610","length":2223},"id":"CVE-2026-40493-2dc229e5","signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"src/sail-codecs/psd/helpers.c","function":"psd_private_sail_pixel_format"}},{"deprecated":false,"digest":{"line_hashes":["85273400961574362229251136605937141962","306159992232681068361938397638659790825","233896929309656568217589203036784684106","175664774383555655165280480391744536255","232879925567746238270794695061371807109","322856476039653229892553228391913140946","19149862439891180422890815573213126847","98123768473269381629547929700714308053"],"threshold":0.9},"id":"CVE-2026-40493-36b85b83","signature_type":"Line","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"src/sail-common/utils.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"src/sail-common/utils.c","function":"sail_bits_per_pixel"},"deprecated":false,"digest":{"function_hash":"213894483933777405872789639568184302313","length":4957},"id":"CVE-2026-40493-3792ca08"},{"source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"tests/sail-common/bytes_per_line.c"},"deprecated":false,"digest":{"line_hashes":["277234587809936347633470930726602524715","266225510950391491359525667755348501379","256339789207071689629507117105456794889"],"threshold":0.9},"id":"CVE-2026-40493-4b37f8c2","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/bindings/sail-python/src/enums_bindings.cpp","function":"init_enums"},"deprecated":false,"digest":{"function_hash":"112082788725860704096248710308133786349","length":18243},"id":"CVE-2026-40493-4e3849b3","signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979"},{"digest":{"function_hash":"251294111510942054229334125121690870043","length":8389},"id":"CVE-2026-40493-528937c8","signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"src/sail-common/common_serialize.c","function":"sail_pixel_format_from_string"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"tests/sail-common/bytes_per_line.c","function":"test_cie_lab"},"deprecated":false,"digest":{"function_hash":"253847532160898436372506940567822017785","length":405},"id":"CVE-2026-40493-72d71125"},{"id":"CVE-2026-40493-753e7e3f","signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"function":"sail_pixel_format_channels","file":"src/sail-common/utils.c"},"deprecated":false,"digest":{"function_hash":"245372989624260089442199684179160566170","length":4241}},{"target":{"file":"src/sail-codecs/psd/psd.c","function":"sail_codec_load_frame_v8_psd"},"deprecated":false,"digest":{"function_hash":"110259096549599551544936205049730706626","length":2743},"id":"CVE-2026-40493-7a5a2ecc","signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979"},{"id":"CVE-2026-40493-7fd6cc28","signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"tests/sail-common/integrity.c","function":"test_pixel_format_to_string"},"deprecated":false,"digest":{"function_hash":"81284175399611265385127402134235724063","length":7437}},{"target":{"file":"src/sail-common/common_serialize.c","function":"sail_pixel_format_to_string"},"deprecated":false,"digest":{"function_hash":"305967067677194111110130658088790466865","length":6499},"id":"CVE-2026-40493-8f77e921","signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979"},{"signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"src/sail-codecs/psd/helpers.c"},"deprecated":false,"digest":{"line_hashes":["145325546552441975844195966247941354470","26639689416253091312251724653478073496","308969595312187959218793755457997602409","79437756706866686041452297236527781219"],"threshold":0.9},"id":"CVE-2026-40493-a02b0a46","signature_type":"Line"},{"digest":{"line_hashes":["147623758926394513724419008686686146504","325318748487292559029037745339558333208","241773928407410648384227570585396445023","296371465870833572339541163082501520600"],"threshold":0.9},"id":"CVE-2026-40493-bcb2d498","signature_type":"Line","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"tests/sail-common/binary_compatibility.c"},"deprecated":false},{"target":{"file":"tests/sail-common/binary_compatibility.c","function":"test_pixel_format_binary_compatibility"},"deprecated":false,"digest":{"function_hash":"80242576731326269003602244027172115750","length":455},"id":"CVE-2026-40493-c0794a25","signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979"},{"source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"tests/sail-common/integrity.c"},"deprecated":false,"digest":{"line_hashes":["124555781669864919256380673008183970067","68073385854072101853472724952446150942","50165605706227335515710470645488008505","322902336340053167466028579449684212632","197710072842476816637687649735978589158","8199322436979542844746362096752609388","73387456529253610294958076581529630709","113682981476445778835270169412391543141"],"threshold":0.9},"id":"CVE-2026-40493-c151c2b8","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"src/bindings/sail-python/src/enums_bindings.cpp"},"deprecated":false,"digest":{"line_hashes":["308122467506156429406148210428912853716","57492694922013962194728210409277640294","99608574921558673103258723864086313473","301778236384678103433140198237463840792"],"threshold":0.9},"id":"CVE-2026-40493-ebd80d48","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["10450314494349027074380514104554945929","155430764995082406420674721471581189392","272140030403766188251477898388761979069","187590772453177003429511917570693641679"],"threshold":0.9},"id":"CVE-2026-40493-f05858a3","signature_type":"Line","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979","target":{"file":"src/sail-common/common.h"}},{"target":{"file":"src/sail-codecs/psd/psd.c"},"deprecated":false,"digest":{"line_hashes":["53110448219753615983494839089796453308","130905564354785826305889895638736945553","51383484694986972127512256972645760023","22140491340691771817299149485678328230","124621281188859374078635702028064338534","328909623183942163537960092546362988011","6316520774941601292866004109213797697","149232201301362048636893363357378721174","160427061207850229954798368260494212594","156979379138965834871201366087255968488","88764146297906181098851896227213024426","336273057275645613072089167056833534756","74844131709812587782139669152737488429","105873685158823493022955273167693269723","915681945215838803497215877786728420","285840621960238461284428405619971707916","74844131709812587782139669152737488429","339386817315552430026401979046203653741","37171390448484340509186002040952349145","288228954381881425393842133560473615915"],"threshold":0.9},"id":"CVE-2026-40493-fccc11c2","signature_type":"Line","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/c930284445ea3ff94451ccd7a57c999eca3bc979"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40493.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}