Executive brief
libsixel is a software library used to encode and decode images into the SIXEL format, often used for displaying graphics in terminal environments. A vulnerability exists where processing a specially crafted, large image file can cause the application to crash or allow an attacker to execute unauthorized code. This occurs when the library incorrectly calculates memory requirements for high-resolution images, leading to memory corruption.
Technical details
An integer overflow exists in the `sixel_frame_convert_to_rgb888()` function within `frame.c`. When processing palettized images (PAL1, PAL2, PAL4), the library performs allocation size and pointer offset calculations using 32-bit integer arithmetic before casting the result to `size_t`. If an image's pixel count exceeds INT_MAX / 4, the calculation wraps around, resulting in an undersized heap allocation and a negative pointer offset. Subsequently, `sixel_helper_normalize_pixelformat()` writes image data to this invalid memory location, causing massive heap corruption. Exploitation requires a user to open a specially crafted PNG file using an application linked against the vulnerable library. The issue is fixed in version 1.8.7-r1.
Affected products
- saitoha libsixel <= 1.8.7
Timeline
- 2026-04-14: disclosed
- 2026-04-14: patched: Fixed in version 1.8.7-r1
- 2026-04-14: advisory