libsixel Signed Integer Overflow (CVE-2026-44637) Leads to Heap Write

The National Vulnerability Database has detailed CVE-2026-44637, a critical vulnerability in libsixel, a SIXEL encoder/decoder library. Specifically, versions up to 1.8.7-r1 are vulnerable to a signed integer overflow within the SIXEL parser’s image-buffer doubling loop. This flaw can result in an out-of-bounds heap write in the sixel_decode_raw_impl function.

The core issue, as described by the National Vulnerability Database, is that context->pos_x increments by repeat_count without any upper bound check. When pos_x nears INT_MAX, the calculation pos_x + repeat_count overflows. This overflow can bypass resize checks, allowing an attacker to write past allocated memory via a large, attacker-influenced offset. Any application decoding attacker-supplied SIXEL data, including img2sixel, is susceptible. The vulnerability carries a CVSS score of 7.1 (HIGH) and has been patched in libsixel version 1.8.7-r2.

This isn’t just theoretical. An out-of-bounds heap write is a classic primitive for arbitrary code execution. Given that SIXEL data can be delivered via various channels, including terminal output or image processing, the attack surface is broader than it might initially appear. Defenders need to recognize that any software using libsixel for image handling, especially in contexts where it processes untrusted input, is at risk.