DEBIAN-CVE-2026-59959

    Dashboard / Vulnerabilities / DEBIAN-CVE-2026-59959

    DEBIAN-CVE-2026-59959

    Published: 28 Oct 2026Last Modified: 30 Oct 2026
    Upstream:
    CVE-2026-59959

    Summary:

    Details: SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or `ANMF` frame metadata. In `sail_codec_load_init_v8_webp()` in `src/sail-codecs/webp/webp.c`, `WebPDemuxGetI` with `WEBP_FF_CANVAS_WIDTH` can return a zero `image_local->width`, which is then used as a divisor when calculating `bytes_per_pixel` from the image row size. The division happens before frame decoding and before generic image skeleton validation in `src/sail/sail_advanced.c`, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.

    References: https://security-tracker.debian.org/tracker/CVE-2026-59959

    Affected packages

    Package

    Name: sail

    Purl: pkg:deb/debian/sail?arch=source&distro=trixie

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    0.9.10-1
    0.9.10-2
    0.9.10-3
    0.9.8-1
    0.9.8-1+deb13u1
    0.9.9-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2026-59959 | CVE-DB