Live › vulnerability › CVE-2026-59959
Go to dashboardSAIL, a cross-platform image loading and saving library, divides by zero when initializing its built-in WebP decoder on a malformed animated WebP file. An attacker who gets a crafted WebP into an application that decodes untrusted images can terminate the process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Applications that use SAIL to load WebP images supplied by users or other untrusted sources are exposed, provided the build includes the WebP codec. Services that only process images they generate themselves, or that do not build the WebP codec, can skip it.
No product ranges from the sources yet.
1.0.2.sail-codecs/webp).1.0.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or ANMF frame metadata. In sail_codec_load_init_v8_webp() in src/sail-codecs/webp/webp.c, WebPDemuxGetI with WEBP_FF_CANVAS_WIDTH can return a zero image_local->width, which is then used as a divisor when calculating bytes_per_pixel from the image row size. The division happens before frame decoding and before generic image skeleton validation in src/sail/sail_advanced.c, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-59959")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.