PT-2026-32927 · Libsixel · Libsixel

Nicoppida · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-33020

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions libsixel versions prior to 1.8.7-r1

Description An integer overflow exists in the sixel frame convert to rgb888() function within frame.c. This occurs when allocation size and pointer offset computations for palettised images (PAL1, PAL2, PAL4) use int arithmetic before casting to size t. For images with a pixel count exceeding INT MAX / 4, an undersized heap allocation is created for the conversion buffer and a negative pointer offset is generated for the normalization sub-buffer. Subsequently, the sixel helper normalize pixelformat() function writes full image data starting from the invalid pointer, leading to heap corruption. A specially crafted large palettised PNG can cause a process crash or potential arbitrary code execution.

Recommendations Update to version 1.8.7-r1.

Exploit

Fix

Heap Based Buffer Overflow

Integer Overflow

Weakness Enumeration

CWE-122

CWE-190

Related Identifiers

CVE-2026-33020

Affected Products

Libsixel

References · 10

• 🔥 https://github.com/saitoha/libsixel/security/advisories/GHSA-2xgm-4x47-2x2p · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-33020 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33020 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33020 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33020 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33020 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33020 · Vendor Advisory
• https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1 · Note
• https://twitter.com/CVEnew/status/2044338909463884170 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044318338440941762 · Twitter Post