SIXEL Buffer Overflow in libsixel Affects Multiple Versions

CVE-2026-44637

What is CVE-2026-44637?

libsixel, a SIXEL encoder/decoder, contains a vulnerability due to a signed integer overflow in its image-buffer doubling mechanism. Specifically, the issue arises in the SIXEL parser's handling of the 'repeat_count' during the decoding process. When 'pos_x' (which increases with each SIXEL character) approaches INT_MAX, an overflow can occur when sizing the image buffer. This unchecked condition allows for an out-of-bounds write into the image's data area, which can be exploited by attackers through specially crafted SIXEL data. This vulnerability can be triggered by any user or system capable of invoking the decoding function, including the img2sixel tool. The issue has been addressed in subsequent versions of the product.

References