Read the docs
TI-2026-32538 Aliases CVE-2026-44638

libsixel: NULL pointer dereference

Priority MEDIUM 46CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00131 2nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed libsixel (saitoha): 1.8.7-r2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
saitohalibsixel1.0.0 to before 1.8.7-r21.8.7-r2Patch availableCNA
  • libsixel Vendorsaitoha Affected 1.0.0 to before 1.8.7-r2 Fixed in 1.8.7-r2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*1.0.0 to before 1.8.7-r2Vulnerablesaitoha
  • cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.8.7-r2 Vulnerable ·saitoha

Remediation

  • Fix · CNA libsixel (saitoha) Fixed in 1.8.7-r2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44638

References

Exploit 1

  • TI-2026-32536 libsixel: integer overflow in encoder CVSS 3.1HIGH 7.8
  • TI-2026-25469 libsixel: Use-after-free in load_with_gdkpixbuf() CVSS 3.1HIGH 7.8
  • TI-2026-32537 libsixel: integer overflow in parser CVSS 3.1HIGH 7.1
  • TI-2026-25466 libsixel: Integer Overflow in write_png_to_file() leads to Heap-based Buffer Overflow CVSS 3.1HIGH 7.1
  • TI-2026-25464 libsixel: Use-After-Free in load_gif() CVSS 3.1HIGH 7.0
  • TI-2026-25467 libsixel: Use-after-free in sixel_encoder_encode_bytes() CVSS 3.1HIGH 7.3
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences