The vulnerability in saitoha's libsixel (CVE-2026-44636) arises from a signed integer overflow during allocation size calculation in the sixel_encode_highcolor function. The public sixel_encode entry point only validates that width and height are greater than zero but does not enforce an upper bound. When the product of width and height exceeds INT_MAX (~2.15 billion), the allocation size calculation wraps around, resulting in a smaller-than-expected heap allocation. This leads to a heap-based buffer overflow when the encoder writes beyond the allocated buffer. Versions affected are from 1.4.4 up to 1.8.7-r1. The issue is resolved in version 1.8.7-r2.

Successful exploitation can lead to heap-based buffer overflow, which may cause application crashes or potentially allow arbitrary code execution. The CVSS vector indicates local attack vector with high complexity and no privileges or user interaction required, impacting confidentiality, integrity, and availability.

Upgrade libsixel to version 1.8.7-r2 or later, where this vulnerability is fixed. Since no official patch links or advisories are provided, users should verify the version in use and apply the update accordingly. Patch status is not explicitly confirmed beyond the stated fix version; check the vendor or project repository for the official release containing the fix.