The vulnerability in saitoha's libsixel (CVE-2026-33020) arises from an integer overflow in sixel_frame_convert_to_rgb888() where int arithmetic is used for allocation size and pointer offset calculations for palettised images. For images with pixel counts exceeding INT_MAX/4, this results in undersized heap allocations and negative pointer offsets, leading to heap buffer overflow during normalization. This heap corruption can be triggered by a crafted large palettised PNG, enabling denial of service or potential arbitrary code execution. The flaw affects versions prior to 1.8.7-r1 and has been addressed in that fixed release.

Exploitation of this vulnerability allows an attacker to corrupt the heap of the victim process by supplying a specially crafted large palettised PNG image. This can cause a reliable crash (denial of service) and may lead to arbitrary code execution. The CVSS score of 7.1 reflects high severity with local attack vector, low complexity, no privileges required, user interaction needed, and high impact on integrity and availability.

This vulnerability is fixed in libsixel version 1.8.7-r1. Users and administrators should upgrade to version 1.8.7-r1 or later to remediate this issue. No other mitigation or temporary workaround is indicated. Patch status is not explicitly confirmed in the vendor advisory, but the fixed version is clearly stated.