CVE-2026-110601
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.
Risk Assessment
An attacker can remotely crash an application processing GIF files, causing denial of service (DoS) and potential memory corruption leading to further exploits.
Recommendation
Upgrade libsixel beyond 1.10.5 or 1.8.7-r1 if available, or implement validation of the transparent index against palette size in GIF files. Consider restricting processing of untrusted GIF files.
Other vulnerabilities in libsixel
See all- CVE-2026-44637High
The libsixel library has a signed integer overflow in the image-buffer doubling loop of the SIXEL parser, which can lead to an out-of-bounds heap write. This issue affects versions up to 1.8.7-r1 and is fixed in version 1.8.7-r2.
- CVE-2026-44636High
The libsixel library has a heap buffer overflow due to incorrect allocation size calculation in the sixel_encode_highcolor function. This issue affects versions from 1.8.7-r1 to 1.8.7-r2, where the lack of an upper bound for width and height allows for potential memory overwrites.
- CVE-2026-33023High
In libsixel versions 1.8.7 and prior, built with --with-gdk-pixbuf2, a use-after-free vulnerability exists in load_with_gdkpixbuf(). The cleanup path manually frees the sixel_frame_t object without consulting the reference count, leading to a dangling pointer. An attacker can supply a crafted image, potentially causing information disclosure, memory corruption, or code execution.
Original NVD description (English source)
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS