Description
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow via sixel_frame_convert_to_rgb888() in frame.c, where allocation size and pointer offset computations for palettised images (PAL1, PAL2, PAL4) are performed using int arithmetic before casting to size_t. For images whose pixel count exceeds INT_MAX / 4, the overflow produces an undersized heap allocation for the conversion buffer and a negative pointer offset for the normalization sub-buffer, after which sixel_helper_normalize_pixelformat() writes the full image data starting from the invalid pointer, causing massive heap corruption confirmed by ASAN. An attacker providing a specially crafted large palettised PNG can corrupt the heap of the victim process, resulting in a reliable crash and potential arbitrary code execution.
This issue has been fixed in version 1.8.7-r1.
Published: 2026-04-14
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution via heap corruption
Action: Immediate Patch
AI Analysis

Impact

libsixel implements SIXEL encoding/decoding and contains an integer overflow in sixel_frame_convert_to_rgb888(). The overflow occurs when calculating allocation sizes for palettised images using int arithmetic. When the pixel count exceeds INT_MAX/4, the conversion buffer is undersized and a negative pointer offset is produced. The subsequent normalization function writes the entire image data starting from this invalid location, causing massive heap corruption. An attacker that can supply a crafted large palettised PNG can trigger the overflow, crash the process, and potentially execute arbitrary code.

Affected Systems

The vulnerability affects the libsixel library produced by saitoha. All releases up to and including version 1.8.7 are susceptible. The issue was fixed in version 1.8.7‑r1.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity of the exploit. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the nature of the heap buffer overflow and reliance on user-supplied PNGs suggest a realistic exploitation path. Inferred attack vector: an adversary can deliver a specially crafted large palettised PNG to any process that uses libsixel to decode or encode images, leading to reliable crashes and a strong possibility of arbitrary code execution if the environment allows execution of malicious payloads.

Generated by OpenCVE AI on April 14, 2026 at 23:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade libsixel to version 1.8.7-r1 or later
  • If an upgrade is not immediately possible, validate or reject PNG files whose pixel count (PAL1, PAL2, PAL4) would cause a buffer allocation exceeding INT_MAX/4 before processing
  • Apply input size or format restrictions in the application layer, or run image processing in a sandboxed environment to contain any potential heap corruption

Generated by OpenCVE AI on April 14, 2026 at 23:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 15 Apr 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Saitoha
Saitoha libsixel
Vendors & Products Saitoha
Saitoha libsixel

Wed, 15 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 14 Apr 2026 22:00:00 +0000

Type Values Removed Values Added
Description libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow via sixel_frame_convert_to_rgb888() in frame.c, where allocation size and pointer offset computations for palettised images (PAL1, PAL2, PAL4) are performed using int arithmetic before casting to size_t. For images whose pixel count exceeds INT_MAX / 4, the overflow produces an undersized heap allocation for the conversion buffer and a negative pointer offset for the normalization sub-buffer, after which sixel_helper_normalize_pixelformat() writes the full image data starting from the invalid pointer, causing massive heap corruption confirmed by ASAN. An attacker providing a specially crafted large palettised PNG can corrupt the heap of the victim process, resulting in a reliable crash and potential arbitrary code execution. This issue has been fixed in version 1.8.7-r1.
Title libsixel: Integer Overflow in write_png_to_file() leads to Heap-based Buffer Overflow
Weaknesses CWE-122
CWE-190
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'}

Subscriptions

Saitoha Libsixel
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-15T13:30:47.463Z

Reserved: 2026-03-17T17:22:14.667Z

Link: CVE-2026-33020

cve-icon Vulnrichment

Updated: 2026-04-15T13:30:37.462Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-14T22:16:30.543

Modified: 2026-04-17T15:38:09.243

Link: CVE-2026-33020

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-14T21:53:00Z

Links: CVE-2026-33020 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T14:31:57Z

Weaknesses