saitoha libsixel up to 1.8.7-r1 SIXEL Encoder sixel_encode_highcolor heap-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in saitoha libsixel up to 1.8.7-r1. The affected element is the function sixel_encode_highcolor of the component SIXEL Encoder. The manipulation results in heap-based overflow. This vulnerability is identified as CVE-2026-44636. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in saitoha libsixel up to 1.8.7-r1. Affected is the function sixel_encode_highcolor of the component SIXEL Encoder. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, signed integer overflow in sixel_encode_highcolor's allocation size calculation can lead to a heap buffer overflow. The public sixel_encode entry point validates only that width and height are greater than zero, with no upper bound. width and height are multiplied as plain int when computing the allocation size for paletted_pixels and normalized_pixels. Any caller that asks libsixel to encode a pixel buffer with width times height greater than INT_MAX (about 2.15 billion) will hit a wrapped allocation size; under the right wrap, the malloc succeeds with a buffer much smaller than the encoder expects, and the encoder writes past the end of the heap allocation. This vulnerability is fixed in 1.8.7-r2.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-44636 since 05/07/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 314945 (Linux Distros Unpatched Vulnerability : CVE-2026-44636), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.8.7-r2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (314945) and EUVD (EUVD-2026-30409). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• saitoha

Name

• libsixel

Version

• 1.8.7-r1

License

• open-source

Website

• Product: https://github.com/saitoha/libsixel/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion