libsixel CVE-2026-44637

Requires user interaction to process attacker-supplied SIXEL data through libsixel decoding functions (UI:R in CVSS vector). Specifically exploitable when a user explicitly opens a malicious SIXEL file with img2sixel, cat/displays it in a SIXEL-capable terminal, or when an application automatically renders untrusted SIXEL content. Does not require authentication (PR:N). The vulnerability triggers in default configurations of libsixel with no special compilation flags or settings required. Exploitation is limited to local attack scenarios (AV:L): the attacker must deliver the malicious SIXEL file to the target system through local file access, social engineering, or as embedded content in documents/terminal sessions the user accesses. Not exploitable remotely without user downloading and opening the crafted file. The local vector and required user action significantly constrain automated exploitation compared to network-accessible vulnerabilities.

CVSS 7.1 (High) reflects significant impact (high integrity and availability loss) tempered by local attack vector and required user interaction. The AV:L/UI:R combination substantially limits exploitation scope compared to network-accessible vulnerabilities. Real-world risk depends heavily on deployment context: terminal emulators automatically rendering SIXEL from untrusted sources (rare in modern deployments) face higher risk than command-line utilities where users explicitly process files. The requirement for user interaction to open/process a malicious SIXEL file significantly reduces automated exploit potential. No EPSS score provided, but the local-only vector and user interaction requirement suggest low probability of mass exploitation. Not present in CISA KEV, indicating no confirmed active exploitation. The vulnerability's technical complexity is low (AC:L) once user interaction occurs, and the attacker-controlled offset in the heap write could enable reliable exploitation by skilled actors. Priority should be moderate: patch affected systems but exploitation requires social engineering to deliver malicious SIXEL files, limiting real-world attack surface compared to remotely exploitable flaws.

An attacker crafts a malicious SIXEL image file with carefully calculated repeat_count values designed to trigger signed integer overflow when pos_x approaches INT_MAX during parsing. The attacker distributes this file via social engineering (email attachment, compromised download site, or malicious terminal output in shared environments). When a user opens the file with img2sixel or views it in a SIXEL-enabled terminal emulator, the parser overflows the buffer size calculation, allocates an undersized heap buffer, then writes attacker-controlled data at a computed offset beyond the allocation boundary. Depending on heap layout and overflow offset, this can corrupt adjacent heap metadata or function pointers, potentially achieving code execution with the privileges of the terminal emulator or utility process.