CVE-2026-44638
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In libsixel (a SIXEL encoder/decoder implementation) up to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value returned by malloc, so on allocation failure the function continues and writes through a NULL pointer, crashing the process. The vulnerability is fixed in 1.8.7-r2.
Risk Assessment
An attacker can trigger a low-memory condition and crash any process using these public libsixel APIs, resulting in denial of service. The risk affects applications processing SIXEL images, particularly in resource-constrained environments.
Recommendation
Update libsixel to version 1.8.7-r2 or later. If updating is not possible, restrict access to SIXEL decoding functionality for untrusted input.
Other vulnerabilities in libsixel
See all- CVE-2026-110601Medium
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.
- CVE-2026-44637High
The libsixel library has a signed integer overflow in the image-buffer doubling loop of the SIXEL parser, which can lead to an out-of-bounds heap write. This issue affects versions up to 1.8.7-r1 and is fixed in version 1.8.7-r2.
- CVE-2026-44636High
The libsixel library has a heap buffer overflow due to incorrect allocation size calculation in the sixel_encode_highcolor function. This issue affects versions from 1.8.7-r1 to 1.8.7-r2, where the lack of an upper bound for width and height allows for potential memory overwrites.
- CVE-2026-33023High
In libsixel versions 1.8.7 and prior, built with --with-gdk-pixbuf2, a use-after-free vulnerability exists in load_with_gdkpixbuf(). The cleanup path manually frees the sixel_frame_t object without consulting the reference count, leading to a dangling pointer. An attacker can supply a crafted image, potentially causing information disclosure, memory corruption, or code execution.
Original NVD description (English source)
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS