Read the docs
TI-2026-32537 Aliases CVE-2026-44637

libsixel: integer overflow in parser

Priority HIGH 66CWE-190Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression "pos_x + repeat_count" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0016 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed libsixel (saitoha): 1.8.7-r2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
saitohalibsixel0.11.0 to before 1.8.7-r21.8.7-r2Patch availableCNA
  • libsixel Vendorsaitoha Affected 0.11.0 to before 1.8.7-r2 Fixed in 1.8.7-r2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*0.11.0 to before 1.8.7-r2Vulnerablesaitoha
  • cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:* Versions 0.11.0 to before 1.8.7-r2 Vulnerable ·saitoha

Remediation

  • Fix · CNA libsixel (saitoha) Fixed in 1.8.7-r2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44637

References

Exploit 1

  • TI-2026-32536 libsixel: integer overflow in encoder CVSS 3.1HIGH 7.8
  • TI-2026-25469 libsixel: Use-after-free in load_with_gdkpixbuf() CVSS 3.1HIGH 7.8
  • TI-2026-25466 libsixel: Integer Overflow in write_png_to_file() leads to Heap-based Buffer Overflow CVSS 3.1HIGH 7.1
  • TI-2026-25464 libsixel: Use-After-Free in load_gif() CVSS 3.1HIGH 7.0
  • TI-2026-25467 libsixel: Use-after-free in sixel_encoder_encode_bytes() CVSS 3.1HIGH 7.3
  • TI-2026-25465 libsixel: Integer overflow leads to Out-of-bounds Read in img2sixel CVSS 3.1HIGH 7.1
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences