CVE-2026-44637

{"id": "CVE-2026-44637", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44637", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-15T13:35:42.115758Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "saitoha", "product": "libsixel", "versions": [{"status": "affected", "version": ">= 0.11.0, < 1.8.7-r2"}]}]}], "published": "2026-05-14T20:17:08.847", "references": [{"url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-9jm7-77gr-qghv", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-9jm7-77gr-qghv", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression \"pos_x + repeat_count\" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2."}, {"lang": "es", "value": "libsixel es una implementaci\u00f3n de codificador/decodificador SIXEL derivada de sixel de kmiya. Hasta la versi\u00f3n 1.8.7-r1, un desbordamiento de entero con signo en el bucle de duplicaci\u00f3n del b\u00fafer de imagen del analizador SIXEL puede provocar una escritura fuera de l\u00edmites en el heap en sixel_decode_raw_impl. context -> pos_x crece por repeat_count en cada car\u00e1cter sixel sin una comprobaci\u00f3n de l\u00edmite superior. Una vez que pos_x se acerca a INT_MAX, la expresi\u00f3n \u2019pos_x + repeat_count\u2019 utilizada para dimensionar el b\u00fafer de imagen desborda el entero con signo. Dependiendo de c\u00f3mo se envuelva el desbordamiento, la comprobaci\u00f3n de redimensionamiento que deber\u00eda rechazar los b\u00faferes sobredimensionados puede ser eludida, despu\u00e9s de lo cual una escritura posterior calcula un gran desplazamiento influenciado por el atacante en image -> data y escribe m\u00e1s all\u00e1 de la asignaci\u00f3n. Alcanzable desde cualquier llamador que decodifique datos SIXEL proporcionados por el atacante, incluyendo img2sixel. Esta vulnerabilidad est\u00e1 corregida en 1.8.7-r2."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E82CD3A-0E58-4567-81F9-C7010DFE4D1E", "versionEndExcluding": "1.8.7-r2", "versionStartIncluding": "0.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}