A heap buffer overflow occurs in the SAIL XWD decoder when the library incorrectly uses the bits_per_pixel value to index a 32‑bit buffer while the pixmap_depth indicates an 8‑bit indexed format. The mismatch causes the byte‑swap loop to read and write four times beyond the allocated memory, corrupting adjacent heap objects. The CVSS score of 9.8 classifies this as a critical flaw that could allow arbitrary code execution or crash the host application.

The vulnerability affects the HappySeaFox Sail image library in all releases before the commit identified by 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02. No specific vendor version numbers are provided, but any build incorporating the XWD decoder without that commit is susceptible.

With an EPSS score not available and the issue not listed in CISA KEV, the probability of widespread exploitation is uncertain, yet the high severity and clear path to out‑of‑bounds writes imply that an attacker who can supply a crafted XWD file could potentially execute arbitrary code. The likely attack vector involves an application that loads XWD images from untrusted sources; the flaw is exploited when pixmap_depth is 8 but bits_per_pixel is 32, a combination the decoder does not validate.