libsixel is a SIXEL encoder/decoder library where a signed integer overflow occurs in the calculation of allocation size inside sixel_encode_highcolor. When a caller supplies a pixel buffer whose width multiplied by height exceeds INT_MAX (~2.15 billion), the multiplication wraps, producing a truncated allocation size. The malloc then allocates a buffer that is too small for the data the encoder writes. This heap buffer overflow can allow an attacker to overwrite adjacent memory, potentially enabling arbitrary code execution or service disruption.

Affected products are the libsixel library provided by Saitoha under the package name saitoha:libsixel. Versions up to and including 1.8.7‑r1 are vulnerable. Applications that embed libsixel for image rendering or processing should verify the version, as any software using the unpatched library is at risk.

The CVSS score of 7.4 describes a high severity flaw. Although the EPSS score is not available, the lack of KEV listing suggests no widespread exploitation yet, but the flaw remains exploitable if an attacker can supply a large image to a vulnerable encoder. The attack vector is likely remote through any interface that feeds pixel data to libsixel; local exploitation is also possible if an application runs with elevated privileges. The absence of mitigations from the library itself means a carefully crafted payload could trigger a memory overwrite with resulting code execution.