Vulnerability · Published May 14, 2026 · Assigned by GitHub_M
CVE-2026-44637libsixel: integer overflow in parser
High 7.1
In plain English
A high-severity integer overflow in libsixel from saitoha. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression "pos_x + repeat_count" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libsixel | no fix listed | DEBIAN-CVE-2026-44637 |
| Debian:13 | libsixel | no fix listed | DEBIAN-CVE-2026-44637 |
| Debian:14 | libsixel | 1:1.8.7-r2-1 | DEBIAN-CVE-2026-44637 |
| Ubuntu:22.04:LTS | libsixel | no fix listed | UBUNTU-CVE-2026-44637 |
| Ubuntu:24.04:LTS | libsixel | no fix listed | UBUNTU-CVE-2026-44637 |
| Ubuntu:25.10 | libsixel | no fix listed | UBUNTU-CVE-2026-44637 |
| Ubuntu:26.04:LTS | libsixel | no fix listed | UBUNTU-CVE-2026-44637 |
| Ubuntu:26.10 | libsixel | no fix listed | UBUNTU-CVE-2026-44637 |
Affected products (as reported)
Weakness: CWE-190, CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
References
- https://github.com/saitoha/libsixel/security/advisories/GHSA-9jm7-77gr-qghv x_refsource_CONFIRM