PT-2026-41033 · Libsixel · Libsixel

Aitoha · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-44637

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions libsixel versions prior to 1.8.7-r2

Description A signed integer overflow exists in the SIXEL parser's image-buffer doubling loop. The context->pos x variable increases by repeat count for every sixel character without an upper bound check. When pos x approaches INT MAX, the expression pos x + repeat count used to size the image buffer overflows. This can bypass the resize check intended to reject oversized buffers, allowing a subsequent write to use a large attacker-influenced offset in image->data and write past the allocation. This issue is reachable via any caller that decodes attacker-supplied SIXEL data, such as img2sixel, and occurs within the sixel decode raw impl() function.

Recommendations Update to version 1.8.7-r2.

Exploit

Fix

Memory Corruption

Integer Overflow

Weakness Enumeration

CWE-787

CWE-190

Related Identifiers

CVE-2026-44637

GHSA-9JM7-77GR-QGHV

Affected Products

Libsixel

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44637.json · Exploit
• 🔥 https://github.com/saitoha/libsixel/security/advisories/GHSA-9jm7-77gr-qghv · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44637 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44637 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-44637 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44637 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44637 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-44637 · Vendor Advisory
• https://twitter.com/CVEnew/status/2055074239070220389 · Twitter Post