The vulnerable library exposes a heap out‑of‑bounds write within the gif_init_frame() function by failing to validate the GIF transparent color index against the palette size. This flaw allows an attacker to feed a specially crafted GIF file with a small color table and a large transparent index to corrupt memory on the heap or trigger a crash. The resulting heap corruption could lead to process termination or, with additional exploitation steps, arbitrary code execution, though the CVE itself does not confirm a privilege escalation vector.

The flaw affects the libsixel library from saitoha, specifically all releases prior to 1.8.7‑r1 and releases from 1.9.0 through 1.10.5. Applications that depend on these vulnerable library versions are at risk when processing GIF images. The vendor supplied CPE indicates the entire library is impacted, no selective modules are listed.

With a CVSS score of 5.8, the risk is moderate. EPSS score of < 1 % indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. The attack requires an application that accepts user‑supplied GIFs and uses the libsixel library to render or process them. While the error can cause a crash, it may also pave the way for more advanced attacks if the attacker can force the corrupted heap to control execution flow. Therefore, patching should be prioritized and observation of anomalous crashes is recommended.