The flaw resides in the base64_decode routine of happyfish100 libfastcommon, where an attacker can supply malformed Base64 data that causes a stack‑based buffer overflow. This overflow may allow the execution of arbitrary code or a crash of the calling process. The vulnerability is triggered by locally crafted input, and public exploits have been released, indicating that the flaw has already been abused in the wild.

Products affected are happyfish100’s libfastcommon library, versions up to and including 1.0.84. The vulnerability is present in the base64.c component of that package. Users running any of these versions should consider the library as vulnerable until the patch with commit identifier 82f66af3e252e3e137dba0c3891570f085e79adf is applied.

The CVSS score of 4.8 places the issue in the medium severity range. The EPSS score of less than 1% suggests a low probability of exploitation, but the vulnerability is listed as publicly disclosed and the exploit is available, so vigilance is warranted. The flaw requires local access to trigger, and it is not catalogued in CISA’s KEV list. Because the attack revolves around stack corruption, timely patching is the primary defense.