CVE-2026-27168: 
NixOS vulnerability analysis and mitigation

CVE-2026-27168 is a heap-based buffer overflow vulnerability in the SAIL (cross-platform image loading/saving library) XWD codec parser. It affects all versions of SAIL up to and including 0.9.10, and was published on February 21, 2026, with the security advisory released by the maintainer on February 18, 2026. The vulnerability was patched in version 1.0.0. The CVSS v3.1 base score is 9.8 (Critical) per Feedly threat intelligence data, though the GitHub advisory scores it 8.8 (High) using an adjacent attack vector (GitHub Advisory, Red Hat CVE).

The root cause is CWE-122 (Heap-based Buffer Overflow) in the XWD parser's xwd_private_read_pixels() function within the sail-codecs-xwd package. The bytes_per_line field is read directly from the XWD file header (via helpers.c: header->bytes_per_line = need_swap ? sail_reverse_uint32(buffer[12]) : buffer[12]) and passed without validation as the read size to io->strict_read(). Because the heap buffer for image pixels is allocated based on the image's actual dimensions, an attacker-controlled bytes_per_line value far exceeding the legitimate buffer size causes a massive out-of-bounds write. A proof-of-concept Python script is publicly available that generates a malicious XWD file with bytes_per_line set to 60,000, confirmed via AddressSanitizer to trigger a WRITE of size 60000 beyond the allocated heap buffer (GitHub Advisory).

Successful exploitation can result in heap metadata corruption, arbitrary code execution via heap exploitation techniques, denial of service, and information disclosure. An unauthenticated attacker who can supply a malicious XWD image file to an application using the SAIL library can achieve full compromise of the affected process, with high impact on confidentiality, integrity, and availability. All applications that depend on SAIL versions ≤ 0.9.10 for image processing are within scope (GitHub Advisory, Feedly).

A public proof-of-concept exploit (a Python script to generate a malicious XWD file) is available in the GitHub security advisory. As of the time of publication, there is no evidence of active in-the-wild exploitation. The EPSS score is 0.017% (0.000170), indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. No specific threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Craft a malicious XWD file: Use the published PoC Python script to generate a malicious XWD file. Set the bytes_per_line field in the XWD header to an arbitrarily large value (e.g., 60,000) while keeping pixmap_width and pixmap_height small (e.g., 10x1 pixels), so the heap buffer allocated for pixels is much smaller than the read size.
2. Deliver the malicious file: Supply the crafted XWD file to a target application that uses the SAIL library for image processing — this could be via file upload, network share, email attachment, or any other vector that causes the application to parse the file.
3. Trigger parsing: The application calls SAIL's XWD parser, which reads bytes_per_line directly from the file header without validation and passes it to io->strict_read(), writing attacker-controlled data far beyond the allocated heap buffer.
4. Achieve heap corruption: The out-of-bounds write corrupts adjacent heap metadata or objects. An attacker can craft the pixel payload to overwrite heap control structures or function pointers, enabling arbitrary code execution under the context of the vulnerable process (GitHub Advisory).

• File System: Presence of unexpected or externally sourced .xwd image files in application upload directories or temporary processing folders; XWD files with a bytes_per_line value disproportionately large relative to image dimensions.
• Process: Crashes or abnormal termination of image-processing applications using SAIL (e.g., segmentation faults, ASAN heap-buffer-overflow reports); unexpected child processes spawned from image-processing services.
• Logs: Application error logs showing heap corruption errors, memory access violations, or ASAN output referencing xwd_private_read_pixels or strict_read; crash dumps from SAIL-dependent processes.
• Network: Unusual inbound file transfers containing XWD-format data to services that process images with SAIL (GitHub Advisory).

Upgrade SAIL to version 1.0.0, which patches this vulnerability by validating bytes_per_line against the actual destination buffer size before use in io->strict_read(). As a workaround where upgrading is not immediately possible, restrict or disable processing of XWD image files in applications using SAIL, and implement network controls to limit exposure to untrusted image sources. Organizations should audit all applications that depend on SAIL ≤ 0.9.10 and prioritize patching (GitHub Advisory, Red Hat CVE).

The vulnerability was covered by The Hacker Wire, which published a dedicated article on the heap-based buffer overflow in SAIL's XWD codec. Social media posts on Mastodon and Bluesky from The Hacker Wire also highlighted the issue. Tenable released Nessus detection plugins (IDs 299722 and 307449) for the vulnerability. CYFIRMA included it in their weekly intelligence report for the week of February 27, 2026 (The Hacker Wire, Tenable).