{"id":"CVE-2026-54627","summary":"SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)","details":"SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psd_private_sail_pixel_format() in src/sail-codecs/psd/helpers.c resolves a one-channel PSD in Bitmap color mode to SAIL_PIXEL_FORMAT_BPP1_INDEXED without requiring the file depth to be one, so the pixel buffer uses one-bit rows while sail_codec_load_frame_v8_psd() in src/sail-codecs/psd/psd.c accepts depth == 8 and writes one attacker-controlled byte per pixel. Loading a crafted PSD through sail_load_from_file() or sail_load_from_memory() therefore writes beyond each heap row, causing memory corruption, a reliable crash, or potential code execution. This mode/depth mismatch is distinct from GHSA-rcqx-gc76-r9mv and GHSA-wcj8-hxxf-pq2c. This issue is fixed in version 1.0.0.","aliases":["GHSA-ccqf-rv86-h3wm"],"modified":"2026-09-20T14:24:45.667212Z","published":"2026-09-17T19:47:14.090Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-122","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54627.json"},"references":[{"type":"WEB","url":"https://github.com/HappySeaFox/sail/releases/tag/v1.0.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54627.json"},{"type":"ADVISORY","url":"https://github.com/HappySeaFox/sail/security/advisories/GHSA-ccqf-rv86-h3wm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54627"},{"type":"FIX","url":"https://github.com/HappySeaFox/sail/commit/f44a8b779a1fc527fc6bc5caa71a66a8ed940d50"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/happyseafox/sail","events":[{"introduced":"0"},{"fixed":"f44a8b779a1fc527fc6bc5caa71a66a8ed940d50"},{"fixed":"0f969168b9d19d43f448d2237990ec247ba822ca"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.0.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v0.9.10","v0.9.9","v0.9.8","v0.9.7","v0.9.6","v0.9.5","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.9.0-rc3","v0.9.0-rc2","v0.9.0-rc1","v0.9.0-pre23","v0.9.0-pre22","v0.9.0-pre21","v0.9.0-pre20","v0.9.0-pre19","v0.9.0-pre18","v0.9.0-pre17","v0.9.0-pre16","v0.9.0-pre15","v0.9.0-pre14","v0.9.0-pre13","v0.9.0-pre12","v0.9.0-pre11","v0.9.0-pre10","v0.9.0-pre9","v0.9.0-pre8","v0.9.0-pre7","v0.9.0-pre6","v0.9.0-pre5","v0.9.0-pre4","v0.9.0-pre3","v0.9.0-pre2","v0.9.0-pre1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54627.json","vanir_signatures_modified":"2026-09-20T14:24:45Z","vanir_signatures":[{"id":"CVE-2026-54627-3527a248","signature_type":"Line","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/f44a8b779a1fc527fc6bc5caa71a66a8ed940d50","target":{"file":"src/sail-codecs/psd/helpers.c"},"deprecated":false,"digest":{"line_hashes":["307488873974150552025479686249349412894","127199678832599759946853843836746941358","147414825653461588994387792370374557997","82308859115016811109377750850125080791","256359552831175530842056331129732691292","187797151996113435274622902569268012964","21447939997633574384980739021306519502","238076186408965368500256795376196638712"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"23220697465794353663822906301135881333","length":3458},"id":"CVE-2026-54627-70896218","signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/f44a8b779a1fc527fc6bc5caa71a66a8ed940d50","target":{"file":"src/sail-codecs/psd/psd.c","function":"sail_codec_load_seek_next_frame_v8_psd"}},{"signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/f44a8b779a1fc527fc6bc5caa71a66a8ed940d50","target":{"file":"src/sail-codecs/psd/psd.c"},"deprecated":false,"digest":{"line_hashes":["111213252273852031844972792108267058801","35526677185886884715583492032543867966","251809861137730582558173170614930102444","166457703013113967008085044865844303259","213668961056980061564323482716250555001","186619349177762486653887087649295199976","2108508743090319265387679230750402631","155067479174323429152205568157349792626","273332748359020092710987005501688784333"],"threshold":0.9},"id":"CVE-2026-54627-8095fe3d","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"215382653890947427923865726994795132696","length":2223},"id":"CVE-2026-54627-e752ecb3","signature_type":"Function","signature_version":"v1","source":"https://github.com/happyseafox/sail/commit/f44a8b779a1fc527fc6bc5caa71a66a8ed940d50","target":{"file":"src/sail-codecs/psd/helpers.c","function":"psd_private_sail_pixel_format"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}