The HappySeaFox sail library prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979 contains an out-of-bounds write vulnerability (CWE-787) in its PSD codec. The issue arises because the bytes-per-pixel (bpp) calculation uses raw header fields (channels * depth), resulting in a bpp of 6 for LAB mode with channels=3 and depth=16. However, the pixel buffer allocation for the BPP40_CIE_LAB format only reserves 5 bytes per pixel. This discrepancy causes every pixel write to exceed the allocated buffer, leading to a deterministic heap buffer overflow on each row. The vulnerability is critical with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue was fixed in commit c930284445ea3ff94451ccd7a57c999eca3bc979.

Successful exploitation of this vulnerability can lead to a heap buffer overflow, potentially allowing an attacker to execute arbitrary code, cause a denial of service, or compromise system integrity and confidentiality. The CVSS score of 9.8 reflects the critical nature of the vulnerability with network attack vector, no privileges required, and no user interaction needed.

A patch addressing this vulnerability was introduced in commit c930284445ea3ff94451ccd7a57c999eca3bc979. Users of the HappySeaFox sail library should upgrade to this commit or a later version that includes the fix. Since this is not a cloud service, remediation depends on applying the updated library version. Patch status is not explicitly confirmed beyond the commit reference; users should verify the vendor's repository or advisory for the official patched release.