Read the docs
TI-2026-81986 Aliases CVE-2026-59959

Division by zero in SAIL WebP decoder on malformed animated files

Priority MEDIUM 55CWE-369Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-369.

Summary

SAIL versions before 1.0.2 are affected. The built-in WebP decoder divides by zero during loader initialization when it processes a malformed animated WebP file with inconsistent container or ANMF frame metadata (CWE-369). A local user who gets an application to open a crafted WebP image can terminate the process, causing denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or `ANMF` frame metadata. In `sail_codec_load_init_v8_webp()` in `src/sail-codecs/webp/webp.c`, `WebPDemuxGetI` with `WEBP_FF_CANVAS_WIDTH` can return a zero `image_local->width`, which is then used as a divisor when calculating `bytes_per_pixel` from the image row size. The division happens before frame decoding and before generic image skeleton validation in `src/sail/sail_advanced.c`, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00125 2nd percentileScored 2026-11-07
Fix Fixed sail (HappySeaFox): 1.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HappySeaFoxsailbefore 1.0.21.0.2Patch availableCNA
  • sail VendorHappySeaFox Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA

Remediation

Upgrade SAIL to version 1.0.2, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA sail (HappySeaFox) Fixed in 1.0.2

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-59959
  2. 2026-10-29 CISA SSVC decision points changed
  3. 2026-10-29 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2026-39458 SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth) CVSS 3.1CRITICAL 9.8
  • TI-2026-39457 SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch) CVSS 3.1CRITICAL 9.8
  • TI-2026-29245 SAIL has heap buffer overflow in TGA RLE decoder — raw packet path missing bounds check CVSS 3.1CRITICAL 9.8
  • TI-2026-29244 SAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit mode CVSS 3.1CRITICAL 9.8
  • TI-2026-29243 SAIL has heap buffer overflow in XWD decoder — bits_per_pixel vs pixmap_depth type confusion in byte-swap CVSS 3.1CRITICAL 9.8
  • TI-2026-39513 SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write) CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences