The HappySeaFox sail library prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 contains an out-of-bounds write vulnerability (CWE-787) in its XWD codec. The issue arises because the pixel format resolution uses pixmap_depth, but the byte-swap code uses bits_per_pixel independently. When pixmap_depth is 8 (indicating a 1 byte per pixel buffer) but bits_per_pixel is 32, the byte-swap loop accesses memory as uint32_t pointers, causing writes four times larger than the allocated buffer. This leads to memory corruption. The vulnerability is distinct from a previous one (CVE-2026-27168) related to bytes_per_line validation. The referenced commit contains a patch that fixes this flaw.

This vulnerability allows an attacker to cause out-of-bounds memory writes, potentially leading to arbitrary code execution, denial of service, or data corruption. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

A patch fixing this vulnerability is included in commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02 of the HappySeaFox sail library. Users should upgrade to this commit or later versions to remediate the issue. Since no official vendor advisory or patch link is provided, verify the patch status with the HappySeaFox project repository or maintainers. No other mitigations are specified.