CVE-2026-33019 libsixel: Integer overflow leads to Out-of-bounds Read in img2sixel
An integer overflow in libsixel's img2sixel tool allows attackers to trigger out-of-bounds heap reads via crafted crop arguments, causing crashes or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33019?
CVE-2026-33019 is a high-severity vulnerability in saitoha libsixel, published on 14 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow leading to an out-of-bounds heap read in the --crop option handling of img2sixel, where positive coordinates up to INT_MAX are accepted without overflow-safe bounds checking. In sixel_encoder_do_clip(), the expression clip_w + clip_x overflows to a large negative value when clip_x is INT_MAX, causing the bounds guard to be skipped entirely, and the unclamped coordinate is passed through sixel_frame_clip() to clip(), which computes a source pointer far beyond the image buffer and passes it to memmove(). An attacker supplying a specially crafted crop argument with any valid image can trigger an out-of-bounds read in the heap, resulting in a reliable crash and potential information disclosure. This issue has been fixed in version 1.8.7-r1.
Which versions are affected by CVE-2026-33019?
It affects 1 product.
Products include Saitoha Libsixel.
How do I fix CVE-2026-33019?
Upgrade to a fixed version.
Is CVE-2026-33019 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33019 exists.
Other vulnerabilities in saitoha libsixel
Sources
Also known as DEBIAN-CVE-2026-33019, GHSA-c854-ffg9-g72c, UBUNTU-CVE-2026-33019.