TI-2026-74095 Aliases CVE-2026-110601 GHSA-5j3r-7cc6-965h

Heap out-of-bounds write in libsixel via crafted GIF

MEDIUM 59CWE-787Published 2026-10-14 · Updated 2026-10-20

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write (CWE-787) in gif_init_frame(), which never checks the GIF transparent color index against the palette size. A crafted GIF with a small color table and large transparent index writes bytes past the palette buffer, corrupting the heap or crashing the process when a user processes it with a background color set.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00236 14th percentileScored 2026-11-07

Fix Fixed libsixel (saitoha): 1.8.7-r1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
saitoha	libsixel	before 1.8.7-r1; 1.9.0 – 1.10.5	1.8.7-r1	Patch available	CNA

libsixel Vendorsaitoha Affected before 1.8.7-r1; 1.9.0 – 1.10.5 Fixed in 1.8.7-r1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:saitoha:libsixel::::::::	—	—	saitoha

cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:* Versions — — ·saitoha

Remediation

Upgrade libsixel to 1.8.7-r1. The sources list no fixed version for libsixel 1.9.0 through 1.10.5.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA libsixel (saitoha) Fixed in 1.8.7-r1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-14 Threatist record created from CVE-2026-110601
2026-10-14 Alias added: GHSA-5j3r-7cc6-965h
2026-10-16 Priority changed: MEDIUM → LOW
2026-10-16 Affected versions changed · Red Hat
2026-10-16 CVSS score added · Red Hat
2026-10-20 CISA SSVC decision points changed
2026-10-20 Priority changed: LOW → MEDIUM

References

Patch 1

https://github.com/saitoha/libsixel/commit/bdbab09816eb9188429c37a50b97c5e66dfe5047

Advisory 1

https://hackmd.io/@haind-pwn/libsixel-gif-transparent-index-oob-write

Other 4

TI-2026-32536 libsixel: integer overflow in encoder CVSS 3.1HIGH 7.8
TI-2026-25469 libsixel: Use-after-free in load_with_gdkpixbuf() CVSS 3.1HIGH 7.8
TI-2026-32537 libsixel: integer overflow in parser CVSS 3.1HIGH 7.1
TI-2026-25466 libsixel: Integer Overflow in write_png_to_file() leads to Heap-based Buffer Overflow CVSS 3.1HIGH 7.1
TI-2026-25464 libsixel: Use-After-Free in load_gif() CVSS 3.1HIGH 7.0
TI-2026-25467 libsixel: Use-after-free in sixel_encoder_encode_bytes() CVSS 3.1HIGH 7.3

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences