CVE-2026-44637 libsixel: integer overflow in parser
A signed integer overflow in the libsixel SIXEL parser allows attackers to trigger an out-of-bounds heap write via crafted image data, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44637?
CVE-2026-44637 is a high-severity vulnerability in saitoha libsixel, published on 14 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression "pos_x + repeat_count" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2.
Which versions are affected by CVE-2026-44637?
It affects 1 product.
Products include Saitoha Libsixel.
How do I fix CVE-2026-44637?
Upgrade to a fixed version.
Is CVE-2026-44637 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44637 exists.
Other vulnerabilities in saitoha libsixel
Sources
Also known as DEBIAN-CVE-2026-44637, GHSA-9jm7-77gr-qghv, UBUNTU-CVE-2026-44637.