libsixel, a SIXEL encoder/decoder, contains a signed integer overflow vulnerability in the image-buffer doubling loop of the SIXEL parser. The variable pos_x increases by repeat_count for each SIXEL character without an upper bound check. When pos_x nears INT_MAX, the calculation pos_x + repeat_count overflows the signed integer, potentially bypassing buffer resize checks. This leads to an out-of-bounds heap write in sixel_decode_raw_impl, allowing memory corruption when decoding crafted SIXEL data. The flaw affects all versions from 0.11.0 up to 1.8.7-r1 and is fixed in 1.8.7-r2.

The vulnerability can cause out-of-bounds heap writes, leading to memory corruption. This may result in denial of service or potentially arbitrary code execution depending on the context in which libsixel is used. The CVSS score of 7.1 reflects high severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. There is no indication of known exploits in the wild at this time.

A fix is available in libsixel version 1.8.7-r2. Users and maintainers should upgrade to this version to remediate the vulnerability. Since the vendor advisory confirms the issue is fixed in 1.8.7-r2, applying this official fix is the recommended mitigation. No additional vendor guidance or temporary workarounds are provided.