CVE-2026-27168 is a high severity (CVSS 8.8) heap buffer overflow in the XWD parser of SAIL, a cross platform image loading library. All versions are affected and the advisory says no fix existed at publication. Avoid parsing untrusted XWD files and check the advisory for updates.
What's affected
The record says all versions of SAIL are affected. The XWD parser reads bytes_per_line from the file and uses it as the read size without comparing it to the destination buffer.
The issue had no fix at the time of publication. Check the project's advisory GHSA-3g38-x2pj-mv55 for later updates before you assume that is still true.
How to check if you're exposed
Find whether SAIL is part of any application you ship or run. It is a C and C++ library, so it may show up as a vendored copy, a system package or a build dependency, not in a language package manager. A software bill of materials helps find it. Safeguard has a free in-browser dependency scan at https://gold.safeguard.sh/scan that checks a dependency file against known CVEs.
Then ask whether the application opens XWD files from outside your control.
What to do now
- Inventory applications that include SAIL, including statically linked copies.
- Stop processing XWD files from untrusted sources, or reject the format at the upload boundary.
- Disable the XWD codec at build time if your configuration allows it.
- Watch the project advisory for a patch and apply it as soon as one exists.
- Run image handling in a sandboxed process with limited rights.
Why it matters
The weakness is CWE-122, heap based buffer overflow. A size value read from an untrusted file controls how much data is written, and nothing checks it against the space that was set aside. Writing past the buffer can crash the program or corrupt memory.
Image parsers are a classic target, since they process complex binary formats from untrusted sources. The record does not mark this CVE as known exploited.
Quick check
Is there a fix?
The record says none existed at publication. Check the project's advisory for the latest status.
Sources
- CVE-2026-27168 on Gold
- GitHub advisory listed in the record: https://github.com/HappySeaFox/sail/security/advisories/GHSA-3g38-x2pj-mv55
Last reviewed: 19 October 2026.
