CVE-2025-53085: 
NixOS vulnerability analysis and mitigation

CVE-2025-53085 is a heap-based buffer overflow vulnerability in the PSD RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decompressing image data from a specially crafted .psd file, the RLE decoding loop writes beyond the bounds of a heap-allocated buffer, enabling remote code execution. The vulnerability was discovered by Cisco Talos, disclosed to the vendor on 2025-07-29, patched on 2025-07-30, and publicly released on 2025-08-25. It carries a CVSS v3.1 base score of 8.8 (High) (Talos Advisory).

The root cause is CWE-122 (Heap-based Buffer Overflow) in sail_codec_load_frame_v8_psd within sail/src/sail-codecs/psd/psd.c. The image decode buffer is allocated based on the product of image width, height, and color depth read from the PSD header. During RLE decompression, the fill loop (for (unsigned i = count; i < count + c; i++)) does not validate that the number of pixels to fill stays within the allocated buffer bounds — allowing an attacker to craft a PSD file with a small declared image size (e.g., 1×1 pixel) but RLE-encoded data that specifies a much larger fill count, overflowing the heap buffer. Exploitation requires user interaction: the attacker must convince the target application or user to open a malicious .psd file processed by the SAIL library. A Python-based proof-of-concept exploit was published alongside the advisory (Talos Advisory).

Successful exploitation results in a heap-based buffer overflow that can achieve remote code execution under the security context of the process using the SAIL library. This grants an attacker full confidentiality, integrity, and availability impact on the affected system, potentially enabling data theft, arbitrary command execution, and system compromise. Any application on Windows, macOS, or Linux that uses SAIL v0.9.8 to process untrusted PSD files is at risk (Talos Advisory).

A proof-of-concept exploit script (poc.py3.zip) was published by Cisco Talos alongside the public advisory on 2025-08-25, demonstrating heap-buffer-overflow via AddressSanitizer. There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is 0.00129 (low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Qualys has a detection available (ID: 6272051) (Talos Advisory).

1. Craft malicious PSD file: Using the published PoC script (poc.py3.zip), generate a .psd file with a minimal declared image size (e.g., Width=1, Height=1, Depth=16, Mode=CMYK) so the library allocates a small heap buffer (e.g., 8 bytes for a single pixel).
2. Set RLE compression: Set the Compression field in the ImageData section to 0x0001 (RLE), triggering the vulnerable RLE decoding path in sail_codec_load_frame_v8_psd.
3. Embed oversized RLE payload: Populate the ImageData section with RLE-encoded bytes where the run-length control byte (>128) specifies a fill count far exceeding the allocated buffer size (e.g., 4096 bytes of \xff fill instructions).
4. Deliver the file: Convince a user or automated pipeline using SAIL v0.9.8 to open the crafted .psd file — via email attachment, file upload, or shared storage.
5. Trigger overflow: When the library decodes the RLE data, the fill loop writes beyond the heap buffer boundary, corrupting adjacent heap memory and potentially redirecting execution flow to attacker-controlled code (Talos Advisory).

• File System: Presence of unexpected or suspicious .psd files in upload directories, temp folders, or user download locations; files with minimal declared dimensions (1×1) but large file sizes.
• Process: Crashes or abnormal termination of applications using the SAIL library when processing .psd files; AddressSanitizer output referencing sail_codec_load_frame_v8_psd in psd.c:266.
• Logs: Application error logs showing heap corruption or segmentation faults originating from SAIL PSD codec functions; crash dumps referencing sail_load_next_frame or sail_codec_load_frame_v8_psd.
• Network: Unexpected outbound connections from image-processing services shortly after processing a .psd file, which may indicate post-exploitation activity (Talos Advisory).

The vendor released a patch on 2025-07-30 (one day after disclosure). Users should update SAIL Image Decoding Library beyond v0.9.8 and the vulnerable master commit 221db576ce1263ab92bd882f344b68b8eec16cad. As interim mitigations: restrict or disable processing of untrusted .psd files, implement file type validation and sandboxing for image processing pipelines, and apply network segmentation to limit exposure of services using SAIL. Tenable Nessus plugin 260371 and Qualys detection ID 6272051 are available for identifying vulnerable instances (Talos Advisory).

Cisco Talos published a detailed technical advisory (TALOS-2025-2219) on 2025-08-25 covering the full vulnerability analysis, crash information, and PoC details. The Talos blog also covered this vulnerability as part of a broader roundup of library vulnerabilities including libbiosig, Tenda, PDF-XChange, and Foxit. No significant independent researcher commentary or notable social media discussion has been identified beyond standard CVE aggregator coverage (Talos Blog).