A critical heap-based buffer overflow in the SAIL Image Decoding Library could allow a remote attacker to execute arbitrary code by supplying a malicious PSD file.

This is an integer overflow vulnerability (CWE-680) occurring during the calculation of image stride in the PSD decoding function. An unauthenticated attacker can trigger this condition by tricking a user into opening a specially crafted PSD file, leading to heap memory corruption.

The ability for an attacker to achieve remote code execution poses a severe threat to system integrity and confidentiality. With a CVSS score of 8.8, this vulnerability is categorized as High, as it allows for full system compromise if the library is integrated into a privileged application or service. Successful exploitation could lead to unauthorized data access, system instability, and potential lateral movement within the network.

Immediate Action: Since a specific patch is not currently listed, administrators should restrict the processing of untrusted PSD files until an official update is released by the vendor.

Proactive Monitoring: Monitor application logs for abnormal crashes or memory access violations that occur when processing image files.

Compensating Controls: Implement file integrity scanning or sandboxing for any services that utilize the SAIL library to decode user-submitted image files.

Public Exploit Available: Unknown.

Given the potential for remote code execution, this vulnerability represents a significant security risk. Organizations relying on the SAIL Image Decoding Library must prioritize identifying where the library is in use and applying vendor-supplied security updates as soon as they become available. Until then, treat all incoming PSD files from untrusted sources as potentially malicious.