CVE Feed

    Dashboard / CVE / CVE-2025-52456

    CVE-2025-52456

    A memory corruption vulnerability exists in the WebP Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .webp animation an integer overflow can be made to occur when calculating the stride for decoding. Afterwards, this will cause a heap-based buffer to overflow when decoding the image which can lead to remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.

    Published:Aug 25, 2025
    Last Modified:Nov 3, 2025
    EPS:Aug 25, 2025
    EPSS Score:0.00234
    CVSS Score:8.8

    Affected Products

    Vendor
    Sail
    Product
    Sail
    Vendor
    Sail Software
    Product
    Sail Image Decoding Library

    Exploits

    https://talosintelligence.com/vulnerability_reports/TALOS-2025-2224

    Related CVEs

    CVE-2026-27168 (CVSS 8.8) — SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC p…
    CVE-2025-46407 (CVSS 8.8) — A memory corruption vulnerability exists in the BMPv3 Palette Decoding functionality of the SAIL Image Decodin…
    CVE-2025-32468 (CVSS 8.8) — A memory corruption vulnerability exists in the BMPv3 Image Decoding functionality of the SAIL Image Decoding …
    CVE-2025-35984 (CVSS 8.8) — A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Li…
    CVE-2025-53510 (CVSS 8.8) — A memory corruption vulnerability exists in the PSD Image Decoding functionality of the SAIL Image Decoding Li…
    CVE-2025-53085 (CVSS 8.8) — A memory corruption vulnerability exists in the PSD RLE Decoding functionality of the SAIL Image Decoding Libr…
    CVE-2025-50129 (CVSS 8.8) — A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Li…
    CVE-2025-52930 (CVSS 8.8) — A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the SAIL Image Decoding Li…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High