CVE-2025-9300 saitoha libsixel img2sixel encoder.c sixel_debug_print_palette stack-based overflow

Medium 4.8 Published 21 Aug 2025 Updated 21 Aug 2025

A stack-based buffer overflow in libsixel allows local attackers to execute arbitrary code or cause denial of service via crafted input.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-9300?

CVE-2025-9300 is a medium-severity memory corruption vulnerability in saitoha libsixel, published on 21 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.

Weakness: CWE-121, CWE-787, CWE-119

Which versions are affected by CVE-2025-9300?

It affects 1 product.

Linux distribution packages (1)

libsixel openSUSE:Tumbleweed All versions 1.10.5-2.1

Products include Saitoha Libsixel.

How do I fix CVE-2025-9300?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-9300 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-9300 exists.

Sources

Also known as DEBIAN-CVE-2025-9300, GHSA-m23p-3g32-h722, UBUNTU-CVE-2025-9300, openSUSE-SU-2025:15526-1.