{"id":"CVE-2026-59959","title":"SAIL: WebP decoder division by zero through malformed animated canvas metadata","summary":"SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed a…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-369"],"vendor":"HappySeaFox","product":"sail","affected":["sail < 1.0.2"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T13:17:29.214Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59959","references":[{"url":"https://github.com/HappySeaFox/sail/security/advisories/GHSA-5g8g-g347-84m8","label":"https://github.com/HappySeaFox/sail/security/advisories/GHSA-5g8g-g347-84m8"},{"url":"https://github.com/HappySeaFox/sail/commit/495660135a4c62e416a1b357a4381dd30069229d","label":"https://github.com/HappySeaFox/sail/commit/495660135a4c62e416a1b357a4381dd30069229d"},{"url":"https://github.com/HappySeaFox/sail/tree/v1.0.2","label":"https://github.com/HappySeaFox/sail/tree/v1.0.2"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T14:12:18.564Z","slug":"CVE-2026-59959","body":"## Overview\n\nSAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or `ANMF` frame metadata. In `sail_codec_load_init_v8_webp()` in `src/sail-codecs/webp/webp.c`, `WebPDemuxGetI` with `WEBP_FF_CANVAS_WIDTH` can return a zero `image_local->width`, which is then used as a divisor when calculating `bytes_per_pixel` from the image row size. The division happens before frame decoding and before generic image skeleton validation in `src/sail/sail_advanced.c`, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.\n\n## Affected\n\n- `sail < 1.0.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}