CVE-2026-44638

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.

CVSS v3 2.5 LOW

2.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w	Exploit Vendor Advisory
https://github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) libsixel es una implementación de codificador/decodificador SIXEL derivada de sixel de kmiya. Desde hasta 1.8.7-r1, una comprobación de NULL incorrecta después de una llamada de asignación en sixel_decode_raw y sixel_decode causa una desreferencia de puntero NULL siempre que la asignación falla. La comprobación prueba la dirección del parámetro de salida (siempre no-NULL) en lugar del valor que malloc devolvió. En caso de fallo de asignación, la función continúa y escribe a través de un puntero NULL, colapsando el proceso. Esto es una denegación de servicio contra cualquier llamador de estas API públicas que alcanza una condición de poca memoria. Esta vulnerabilidad está corregida en 1.8.7-r2.

Information

Published : 2026-05-14 20:17

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44638

Mitre link : CVE-2026-44638

CVE.ORG link : CVE-2026-44638

JSON object : View

Products Affected

saitoha

libsixel

CWE

CWE-476

NULL Pointer Dereference

CWE-690

Unchecked Return Value to NULL Pointer Dereference

{"id": "CVE-2026-44638", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44638", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T14:17:38.241135Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.0}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "saitoha", "product": "libsixel", "versions": [{"status": "affected", "version": ">= 1.0.0, < 1.8.7-r2"}]}]}], "published": "2026-05-14T20:17:08.983", "references": [{"url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}, {"lang": "en", "value": "CWE-690"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2."}, {"lang": "es", "value": "libsixel es una implementaci\u00f3n de codificador/decodificador SIXEL derivada de sixel de kmiya. Desde hasta 1.8.7-r1, una comprobaci\u00f3n de NULL incorrecta despu\u00e9s de una llamada de asignaci\u00f3n en sixel_decode_raw y sixel_decode causa una desreferencia de puntero NULL siempre que la asignaci\u00f3n falla. La comprobaci\u00f3n prueba la direcci\u00f3n del par\u00e1metro de salida (siempre no-NULL) en lugar del valor que malloc devolvi\u00f3. En caso de fallo de asignaci\u00f3n, la funci\u00f3n contin\u00faa y escribe a trav\u00e9s de un puntero NULL, colapsando el proceso. Esto es una denegaci\u00f3n de servicio contra cualquier llamador de estas API p\u00fablicas que alcanza una condici\u00f3n de poca memoria. Esta vulnerabilidad est\u00e1 corregida en 1.8.7-r2."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07609BEC-B5AE-4004-8DF0-DCA17A16DF56", "versionEndExcluding": "1.8.7-r2", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}