SAIL is a cross‑platform image library used to load and save images with animation, metadata, and ICC profiles. The vulnerability is a heap‑based buffer overflow in the XWD file parser; the parser reads the bytes_per_line field from the file and uses it directly as the read size without verifying the destination buffer size. An attacker can supply an XWD file with a very large bytes_per_line value, causing an out‑of‑bounds write that can corrupt the heap and potentially lead to arbitrary code execution or a denial‑of‑service crash. The weakness is a classic buffer overrun identified as CWE‑122.

All releases of the HappySeaFox SAIL library are affected. The advisory lists the product as HappySeaFox:sail and indicates that every version contains the vulnerability. No specific version ranges are provided, so any deployment of the library, regardless of version, should be considered vulnerable.

The advisory assigns a CVSS v3 score of 8.8, indicating high severity, but the EPSS score is less than 1% and the vulnerability is not in CISA’s KEV catalog. This suggests that exploitation is technically feasible but requires an attacker to supply a crafted XWD file and the target application must be processing such files. The attack vector is likely through file upload or remote file inclusion, and mitigation actions are required until a patch is released. The risk remains significant for systems that accept untrusted image files.