CVE-2026-110601

The libsixel library versions before 1.8.7-r1 and 1.9.0 through 1.10.5 are vulnerable to a heap out-of-bounds write in the gif_init_frame() function located in src/fromgif.c. The root cause is a failure to validate the GIF transparent color index against the actual palette size . An attacker can ...