CVE Watch29 de out. de 2026

CVE-2026-59959

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.

CVSS

—

Sem CVSS

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 28 de out. de 2026 · Última mod.: 29 de out. de 2026 · CWE-369

EPSS · 30d

0.1%EPSS · 30 dias0.1%

2026-10-292026-11-05

Descrição técnica

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or `ANMF` frame metadata. In `sail_codec_load_init_v8_webp()` in `src/sail-codecs/webp/webp.c`, `WebPDemuxGetI` with `WEBP_FF_CANVAS_WIDTH` can return a zero `image_local->width`, which is then used as a divisor when calculating `bytes_per_pixel` from the image row size. The division happens before frame decoding and before generic image skeleton validation in `src/sail/sail_advanced.c`, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1073596.5 MÉD

—

——0Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault.7h CVE-2026-1223305.5 MÉD

—

——0Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.6h CVE-2026-1214104.3 MÉD

14.4%

——4FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width and height, triggering an assertion or division by zero that terminates the client session.2d CVE-2026-651605.5 MÉD

5.6%

——2NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of service.2d CVE-2026-1120545.5 MÉD

7.9%

——2Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slice_bytes_denom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schro_decoder_parse_transform_parameters and schro_decoder_parse_lowdelay_transform_data to trigger a SIGFPE and cause denial of service.15d CVE-2026-1120135.5 MÉD

2.7%

——1libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the bundled tta console tool.17d