All vulnerabilities
CVE-2026-59959GHSA-5g8g-g347-84m8

SAIL: WebP decoder division by zero through malformed animated canvas metadata

HappySeaFox sail
CVSS
4.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or ANMF frame metadata. In sail_codec_load_init_v8_webp() in src/sail-codecs/webp/webp.c, WebPDemuxGetI with WEBP_FF_CANVAS_WIDTH can return a zero image_local->width, which is then used as a divisor when calculating bytes_per_pixel from the image row size. The division happens before frame decoding and before generic image skeleton validation in src/sail/sail_advanced.c, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.

Text from CVE List

Affected versions 1

  • sailaffected: < 1.0.2CVE List

References 3