A critical heap-based buffer overflow in the HappySeaFox sail library, version 0.9.10 and earlier, poses a severe risk of arbitrary code execution for applications processing untrusted PSD files.

This vulnerability is a heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) occurring within the PSD parsing logic. An unauthenticated attacker can trigger this flaw by providing a maliciously crafted PSD file, leading to memory corruption during the image loading process.

The potential for remote code execution makes this a critical security risk for any system utilizing the sail library to process user-supplied image data. With a CVSS score of 9.8, the vulnerability allows full compromise of the affected application, including potential data exfiltration and complete system takeover. Organizations relying on this library for image processing services face significant threats to both data confidentiality and operational integrity.

Immediate Action: Update the HappySeaFox sail library to version 1.0.0 or later immediately.

Proactive Monitoring: Monitor application logs for unexpected crashes or segmentation faults occurring during image processing tasks, which may indicate attempted exploitation.

Compensating Controls: Implement strict input validation or sandboxing for any services that process external PSD files to limit the impact of potential memory corruption attacks.

Public Exploit Available: Unknown

Given the critical CVSS severity and the potential for remote code execution, this vulnerability requires immediate attention. Security teams must identify all instances of the sail library within their environment and prioritize patching to version 1.0.0. Failure to address this flaw leaves systems highly vulnerable to exploitation via common image file vectors.