CVE-2025-46407

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-08-25 · updated 2026-06-17
Weakness: CWE-680

Description

A memory corruption vulnerability exists in the BMPv3 Palette Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .bmp file, an integer overflow can be made to occur which will cause a heap-based buffer to overflow when reading the palette from the image. These conditions can allow for remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.

Affected products

SAIL Image Decoding Library: 0.9.8

References

https://talosintelligence.com/vulnerability_reports/TALOS-2025-2215
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2215

Get alerted when CVE-2025-46407 or the next vulnerability affects your stack