CVE-2021-46700

What it actually does

Double-free memory corruption in sixel_encoder_output_without_macro (called via sixel_encoder_encode_frame) allows an attacker-supplied sixel image to trigger repeated deallocation of the same heap buffer, resulting in heap metadata corruption and a process crash.

Why it matters to the business

Image-processing applications or services that accept untrusted sixel content can be forced offline, causing availability loss for dependent workflows until the affected process or host is restarted.

How an attack unfolds

An attacker crafts a malicious sixel image that exercises the double-free path inside sixel_encoder_encode_frame; when the victim application decodes or encodes the image, the library frees the same pointer twice, corrupting heap state and terminating the process.

How to fix it

Upgrade to a version of libsixel that contains the fix for the double-free condition; if no patched release is available, replace the library with an alternative sixel implementation or disable sixel processing for untrusted input.

How to confirm the fix worked

Rebuild or run the application against a test suite containing the previously crashing sixel sample; confirm absence of crash and that heap sanitizers (ASAN, Valgrind) report no double-free on the same input.

Typical attack path

1. Identify a target application or service that uses libsixel to handle sixel images
2. Deliver a crafted sixel payload via network upload, file attachment, or web rendering
3. Trigger image processing in sixel_encoder_encode_frame
4. Induce double free and resulting crash or denial of service

How to detect it

Review application or library logs for segmentation faults, abort signals, or heap-error messages immediately after sixel image processing; correlate with incoming image uploads or rendering requests around the same timestamp.

What your security team should do

• Prioritize patching or replacing libsixel in any internet-facing or multi-tenant image-processing paths
• Add sixel decoding to the list of untrusted input formats that require sandboxing or resource limits
• Monitor EPSS trend and exploit availability; schedule remediation within normal change windows given moderate exploit maturity