Critical Heap Overflow in SAIL TGA Codec (CVE-2026-40494)

The National Vulnerability Database has disclosed CVE-2026-40494, a critical heap buffer overflow vulnerability in SAIL, a widely used cross-platform image loading and saving library. Rated with a CVSS score of 9.8, this flaw resides in the TGA codec’s RLE decoder within tga.c.

Specifically, the issue stems from an asymmetric bounds check. While the run-packet path correctly clamps repeat counts, the raw-packet path (lines 305-311) lacks this crucial validation. This oversight permits an attacker to write up to 496 bytes of controlled data past the end of a heap buffer, leading to potential arbitrary code execution or denial of service. The vulnerability has been patched in commit 45d44b1f2e8e0d73e80bc1fd5310cb57f4547302.

This is a severe vulnerability. Given SAIL’s role in handling images, any application or system processing untrusted image files via the library is at risk. Defenders must identify where SAIL is deployed in their environment and prioritize patching. Attackers will quickly weaponize this for initial access or privilege escalation, leveraging the image processing chain as an entry point.