Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-44638: libsixel can crash when memory runs out

CVE-2026-44638 · published 5 months ago

Summary

The libsixel library used for SIXEL image handling may crash if the system runs low on memory. When memory allocation fails, the code checks the wrong value and then writes to a null pointer, causing the program to stop working. Upgrade to version 1.8.7-r2 or later to prevent the crash.

What to do

Update saitoha libsixel to version 1.8.7-r2 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:14	debian	libsixel	All versions
Debian:11	debian	libsixel	All versions
Debian:12	debian	libsixel	All versions
Debian:13	debian	libsixel	All versions
Ubuntu:16.04:LTS	canonical	libsixel	All versions
–	saitoha	libsixel	>= 1.0.0, < 1.8.7-r2 `cpe:2.3:a:saitoha:libsixel::::::::`

Original advisory text

libsixel: NULL pointer dereference

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.

References

https://github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w Exploit Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-44638 Vendor Advisory
https://ubuntu.com/security/CVE-2026-44638 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-44638 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44638... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44638 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.5 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

CWE-690Unchecked Return Value to NULL Pointer Dereference

Timeline

Published14 May 2026

Updated26 Oct 2026

First seen14 May 2026

Sources

CVE-2026-44638 · NVD

DEBIAN-CVE-2026-44638 · OSV

UBUNTU-CVE-2026-44638 · OSV

CVE-2026-44638 · OSV

GHSA-wpx3-h5g8-qr3w · GHSA

Track software like this

Free during beta