Vulnerability · Published May 14, 2026 · Assigned by GitHub_M
CVE-2026-44636libsixel: integer overflow in encoder
High 7.4
In plain English
A high-severity heap buffer overflow in libsixel from saitoha. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocation size calculation can lead to a heap buffer overflow. The public sixel_encode entry point validates only that width and height are greater than zero, with no upper bound. width and height are multiplied as plain int when computing the allocation size for paletted_pixels and normalized_pixels. Any caller that asks libsixel to encode a pixel buffer with width times height greater than INT_MAX (about 2.15 billion) will hit a wrapped allocation size; under the right wrap, the malloc succeeds with a buffer much smaller than the encoder expects, and the encoder writes past the end of the heap allocation. This vulnerability is fixed in 1.8.7-r2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libsixel | no fix listed | DEBIAN-CVE-2026-44636 |
| Debian:13 | libsixel | no fix listed | DEBIAN-CVE-2026-44636 |
| Debian:14 | libsixel | 1:1.8.7-r2-1 | DEBIAN-CVE-2026-44636 |
| Ubuntu:22.04:LTS | libsixel | no fix listed | UBUNTU-CVE-2026-44636 |
| Ubuntu:24.04:LTS | libsixel | no fix listed | UBUNTU-CVE-2026-44636 |
| Ubuntu:25.10 | libsixel | no fix listed | UBUNTU-CVE-2026-44636 |
| Ubuntu:26.04:LTS | libsixel | no fix listed | UBUNTU-CVE-2026-44636 |
| Ubuntu:26.10 | libsixel | no fix listed | UBUNTU-CVE-2026-44636 |
Affected products (as reported)
Weakness: CWE-122, CWE-190 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/saitoha/libsixel/security/advisories/GHSA-hx93-w8p2-ffh5 x_refsource_CONFIRM