Medium 4.8Published Oct 28, 2026

CVE-2026-59959SAIL: WebP decoder division by zero through malformed animated canvas metadata

Updated under an hour ago (Oct 29, 2026, 2:10 PM ET)

Does this affect you?

It affects HappySeaFox sail. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for HappySeaFox sail Exploited in the last 30 days

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or `ANMF` frame metadata. In `sail_codec_load_init_v8_webp()` in `src/sail-codecs/webp/webp.c`, `WebPDemuxGetI` with `WEBP_FF_CANVAS_WIDTH` can return a zero `image_local->width`, which is then used as a divisor when calculating `bytes_per_pixel` from the image row size. The division happens before frame decoding and before generic image skeleton validation in `src/sail/sail_advanced.c`, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.

CVSS: 4.8 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness (CWE): CWE-369
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Oct 28, 2026
First seen by InfoSec Signals: Oct 28, 2026

Affected products

Affected products

HappySeaFox sail happyseafox:sail (from the name)	before 1.0.2	CNA record

References

References

https://github.com/HappySeaFox/sail/security/advisories/GHSA-5g8g-g347-84m8	x-refsource-confirm
https://github.com/HappySeaFox/sail/commit/495660135a4c62e416a1b357a4381dd30069229d	x-refsource-misc
https://github.com/HappySeaFox/sail/tree/v1.0.2	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.