xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in setsixel in graphicssixel.c via crafted text.
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-8456.json"