libsixel, a SIXEL encoder/decoder library, contains a signed integer overflow in its parser. When the horizontal position counter increases with the repeat count from each SIXEL character, the calculation "pos_x + repeat_count" can exceed the maximum signed integer value. If this overflow occurs, the subsequent buffer resize check that should prevent oversized buffers can be bypassed, allowing a write to a large attacker‑controlled offset into the image data. This out‑of‑bounds heap write can corrupt memory, potentially giving an attacker the ability to execute arbitrary code. The vulnerability is reachable from any component that decodes user‑supplied SIXEL data, including the img2sixel utility.

The flaw exists in versions of libsixel up to and including 1.8.7‑r1, which is maintained by saitoha. All releases prior to 1.8.7‑r2 are affected. Updating to 1.8.7‑r2 or later removes the integer‑overflow check and prevents the buffer overflow.

With a CVSS score of 7.1 and no EPSS data, the vulnerability is considered high risk. The attack vector is local to any process that accepts untrusted SIXEL data, so an attacker who can supply such data to a vulnerable application could trigger the heap corruption. The vulnerability is not listed in the CISA KEV catalog and no exploit is known to be actively used, but the lack of bounds checking makes exploitation plausible.