CVE-2026-44636: libsixel Integer Overflow Leads to Heap Buffer Overflow

The National Vulnerability Database (NVD) has detailed CVE-2026-44636, a high-severity vulnerability (CVSS 7.4) affecting libsixel, a SIXEL encoder/decoder implementation. Versions up to 1.8.7-r1 are susceptible to a signed integer overflow within the sixel_encode_highcolor function. This flaw occurs during allocation size calculation, specifically when multiplying width and height as plain integers for paletted_pixels and normalized_pixels.

Attackers can exploit this by providing width and height values that, when multiplied, exceed INT_MAX. This leads to a wrapped allocation size, resulting in malloc returning a much smaller buffer than expected. Consequently, the encoder attempts to write beyond the allocated heap space, triggering a heap buffer overflow. While sixel_encode validates positive dimensions, it lacks an upper bound check, making this attack vector viable. The vulnerability is addressed in libsixel version 1.8.7-r2.

This isn’t just theoretical. A heap buffer overflow is a prime candidate for remote code execution, especially in applications that process untrusted image data. The attacker’s calculus here is simple: craft a malicious SIXEL image that triggers the overflow, then leverage the memory corruption to gain control. Defenders need to recognize that any application using vulnerable versions of libsixel to process user-supplied images is a potential target.