The libsixel library, used for SIXEL encoding/decoding, has a heap-based buffer overflow vulnerability (CVE-2026-44636) in versions >= 1.4.4 and < 1.8.7-r2. The vulnerability stems from a signed integer overflow in the calculation of allocation size in the sixel_encode_highcolor function. Specifically, the width and height parameters are only checked to be positive but not bounded, and their product is computed as a signed int. If width * height exceeds INT_MAX (~2.15 billion), the multiplication wraps around, causing malloc to allocate a smaller buffer than needed. The encoder then writes beyond the allocated heap buffer, leading to a heap overflow. This can impact confidentiality, integrity, and availability of the affected system. The vulnerability is addressed in libsixel version 1.8.7-r2.

Successful exploitation of this vulnerability can result in a heap-based buffer overflow, potentially allowing an attacker to corrupt memory, cause a crash, or execute arbitrary code with the privileges of the process using libsixel. The CVSS 3.1 score is 7.4 (High), indicating significant impact to confidentiality, integrity, and availability. However, exploitation requires supplying specially crafted input with very large width and height values, and local access (attack vector is local).

A fix is available in libsixel version 1.8.7-r2. Users and maintainers should upgrade to version 1.8.7-r2 or later to remediate this vulnerability. Since no official patch link or advisory is provided, verify the upgrade through the official libsixel project sources. Until upgraded, avoid processing SIXEL images with extremely large dimensions that could trigger the overflow.