CVE-2026-59959Medium· 4.8▾ SunlitSAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or ANMF frame metadata. In sail_codec_load_init_v8_webp() in src/sail-codecs/webp/webp.c, WebPDemuxGetI with WEBP_FF_CANVAS_WIDTH can return a zero image_local->width, which is then used as a divisor when calculating bytes_per_pixel from the image row size. The division happens before frame decoding and before generic image skeleton validation in src/sail/sail_advanced.c, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.
sail < 1.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54692High· 7.8SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles
CVE-2026-54626Critical· 9.8SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles
CVE-2026-54627Critical· 9.8SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles
CVE-2022-49294Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check if modulo is 0 before dividing. [How & Why] If a value of 0 is read, then this will cause a divide-by-0 panic.
CVE-2026-112054Medium· 5.5Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing
CVE-2026-112013Medium· 5.5libtta through 2.3 Divide by Zero via tta_decoder_init_get_info