CVE-2026-44637
HighSummary
The libsixel library has a signed integer overflow in the image-buffer doubling loop of the SIXEL parser, which can lead to an out-of-bounds heap write. This issue affects versions up to 1.8.7-r1 and is fixed in version 1.8.7-r2.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious code by manipulating SIXEL data, potentially leading to unauthorized memory access and system crashes.
Recommendation
It is recommended to update the libsixel library to version 1.8.7-r2 or later to mitigate this vulnerability.
Other vulnerabilities in libsixel
See all- CVE-2026-44636High
The libsixel library has a heap buffer overflow due to incorrect allocation size calculation in the sixel_encode_highcolor function. This issue affects versions from 1.8.7-r1 to 1.8.7-r2, where the lack of an upper bound for width and height allows for potential memory overwrites.
- CVE-2026-33023High
In libsixel versions 1.8.7 and prior, built with --with-gdk-pixbuf2, a use-after-free vulnerability exists in load_with_gdkpixbuf(). The cleanup path manually frees the sixel_frame_t object without consulting the reference count, leading to a dangling pointer. An attacker can supply a crafted image, potentially causing information disclosure, memory corruption, or code execution.
Original NVD description (English source)
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression "pos_x + repeat_count" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2.