CVE-2026-44636 Details
Description
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocation size calculation can lead to a heap buffer overflow. The public sixel_encode entry point validates only that width and height are greater than zero, with no upper bound. width and height are multiplied as plain int when computing the allocation size for paletted_pixels and normalized_pixels. Any caller that asks libsixel to encode a pixel buffer with width times height greater than INT_MAX (about 2.15 billion) will hit a wrapped allocation size; under the right wrap, the malloc succeeds with a buffer much smaller than the encoder expects, and the encoder writes past the end of the heap allocation. This vulnerability is fixed in 1.8.7-r2.
A heap buffer overflow vulnerability has been identified in libsixel versions 1.4.4 through 1.8.7-r1. This issue arises from a signed integer overflow in the 'sixel_encode_highcolor' function, where the allocation size for pixel buffers is incorrectly calculated. The public 'sixel_encode' function only checks that width and height are greater than zero, without imposing any upper limits. As a result, if a pixel buffer is requested with dimensions that, when multiplied, exceed the maximum value for an integer, the allocation size wraps around to a smaller value. This allows the 'malloc' function to succeed in allocating a buffer that is insufficient for the encoder's needs, leading to a buffer overflow as the encoder writes past the allocated memory.
Users can upgrade to libsixel version 1.8.7-r2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/saitoha/libsixel/security/advisories/GHSA-hx93-w8p2-ffh5 | CISA-ADP | Vendor Advisory |
| https://github.com/saitoha/libsixel/security/advisories/GHSA-hx93-w8p2-ffh5 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| saitoha libsixel | >= 1.4.4, < 1.8.7-r2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 16, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | New CVE Received | [email protected] |