A critical heap-based buffer overflow in the HappySeaFox sail library allows an unauthenticated attacker to cause memory corruption or execute arbitrary code by supplying a malicious TGA image.

This vulnerability is a heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) occurring in the TGA codec implementation. An unauthenticated attacker can trigger the flaw by providing a crafted color-mapped run-length-encoded TGA file, which causes the library to write data beyond the allocated heap buffer.

The potential for remote code execution poses a severe threat to the confidentiality, integrity, and availability of any system utilizing the affected library. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it allows full system compromise without requiring user interaction or authentication.

Immediate Action: Update the HappySeaFox sail library to version 1.0.0 or later immediately.

Proactive Monitoring: Monitor application logs for unexpected crashes or segmentation faults when processing image uploads, as these may indicate attempted exploitation.

Compensating Controls: If an immediate update is not feasible, restrict the ability of the application to process TGA files from untrusted sources, or implement strict input validation to sanitize image headers before processing.

Public Exploit Available: Unknown

Due to the critical nature of this vulnerability and the potential for remote code execution, organizations must prioritize the transition to version 1.0.0. The ability to trigger this flaw via unauthenticated network access necessitates immediate patching to prevent potential system-level exploitation.