CVE-2026-110601

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110601
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110601.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110601
Downstream
Published
2026-10-14T14:16:43Z
Modified
2026-10-28T11:06:32Z
Severity
  • 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF
Details

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110601.json"
}
References

Affected packages

Git / github.com/libsixel/libsixel

Affected ranges

Type
GIT
Repo
https://github.com/libsixel/libsixel
Events
Introduced
857185461d8703bbe4f4ed4b5c18f8292fd675f2
Last Affected
37026b01a0bd38634ae0a8c5017bd4671101fe08
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.9.0"
                },
                {
                    "last_affected": "1.10.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "1.9.0"
                },
                {
                    "last_affected": "1.10.5"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
Type
GIT
Repo
https://github.com/saitoha/libsixel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6d628cf43548e1f2739cbb13afcc6e8257868db5
Fixed
bdbab09816eb9188429c37a50b97c5e66dfe5047
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.8.7-r1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "bdbab09816eb9188429c37a50b97c5e66dfe5047"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.8.7-r1",
            "range": [
                {
                    "fixed": "6d628cf43548e1f2739cbb13afcc6e8257868db5"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other
nightly-latest
v0.*
v0.14.0
v0.15.0
v0.16.0
v0.16.1
v0.17.0
v0.17.1
v0.17.2
v0.18.0
v0.19.2
v0.19.3
v0.19.4
v0.19.5
v0.19.6
v0.20.0
v0.21.0
v0.21.1
v0.22.0
v0.22.1
v0.22.2
v0.22.3
v0.23.0
v0.23.1
v0.23.2
v0.24.0
v0.24.2
v0.25.0
v0.25.1
v0.25.2
v0.25.3
v0.25.4
v0.25.5
v0.26.0
v0.27.0
v0.27.1
v0.28.0
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.1.2
v1.10.0
v1.10.1
v1.10.2
v1.10.4
v1.10.5
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.4.0
v1.4.1
v1.4.10
v1.4.11
v1.4.12
v1.4.13
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5.0
v1.5.1
v1.5.2
v1.6.1
v1.7.1
v1.7.2
v1.7.3
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110601.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "312985605293825738752306862570963759341",
            "length": 5078
        },
        "id": "CVE-2026-110601-32690fc6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/saitoha/libsixel/commit/bdbab09816eb9188429c37a50b97c5e66dfe5047",
        "target": {
            "file": "src/fromgif.c",
            "function": "gif_load_next"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "206289290610331253870052209232172393433",
            "length": 3160
        },
        "id": "CVE-2026-110601-39a1be08",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/saitoha/libsixel/commit/bdbab09816eb9188429c37a50b97c5e66dfe5047",
        "target": {
            "file": "src/fromgif.c",
            "function": "gif_init_frame"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "41603360946628637545984865066147078525",
            "length": 3518
        },
        "id": "CVE-2026-110601-3d0bc22e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/saitoha/libsixel/commit/bdbab09816eb9188429c37a50b97c5e66dfe5047",
        "target": {
            "file": "src/fromgif.c",
            "function": "load_gif"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "265776886901787004881604207464268416687",
                "193579359285823269107568333591198431341",
                "288949278359187525449115080213447018673",
                "75079852933947154359936029739721576661",
                "213438981923775271327897410742180065244",
                "262974348432268058623433404271921662501",
                "327649000964386556214855383420154700828",
                "68487315967094021020964001341694850945",
                "1034130811528261816865446262549320324",
                "203304660930413008531134269480883417889",
                "272959831135605862066991458560054782443",
                "42984032017397541507255105810290752964",
                "208575099522184448993155713557395447529",
                "212007400117425054430588155775604920143",
                "285162423704301504209187959453707811150",
                "52153722301678040184817666619445778648",
                "122410003470821893471370811100041174899",
                "36461757992988505103095109227208706949",
                "217287072596851807609079644474912372769",
                "146858722487970233038145983993292146104",
                "249333885473207240405605707994714797036",
                "241881474131080486187334722676447727464",
                "1251956278313414376285467634648895832",
                "11889069712120634908036943451068176868",
                "50787231773553395976697347263099903",
                "60557541116808579836305102930121295704",
                "166735423174706802148484698467735260281",
                "227701777119697454437797511863821189739",
                "103166920736623106180479968363656449168",
                "14915148443908316391883012952964013219",
                "105014428066368821239780368437051150028",
                "208889145390363502503589108242117058451",
                "265231968927012168981703834787221318365",
                "30978765025026318365814098998774665876",
                "329319927834399607687965671394285462199",
                "62985721880421525107869850432464485764",
                "222961957185980799782448078992366180684",
                "326290016504206435855637141411573800729",
                "270162228189684528834595387431971076550",
                "132296623425679266137649341010237695486",
                "272287079392235350707916094414195385725",
                "262084435527837513015703330359985669378",
                "151126163262368383169397138575281586750",
                "58090535595305567216363546487882375017",
                "244016437746791545871870743389784397800",
                "225167857841350146089093891127216693211",
                "27503036434550624693815320135352805886",
                "142346221735055669826274110323565961842",
                "265196732384815515530850195852467168370",
                "223101461421931000181348346751045643695",
                "43541475612639710077817872953366973913",
                "315356322928239243626844894259748630801",
                "179386858639001927763330249514124088145",
                "80608196369949524394389360058744850440",
                "158569223671762209137945595180289044190",
                "162147575614427890156971511672168549409",
                "275992215724900411124818904376968358938",
                "113685457977302610727849083317514330080",
                "201128126745100093571011688707968061235",
                "106190091866936560548080440516866460255",
                "265196732384815515530850195852467168370",
                "223101461421931000181348346751045643695",
                "43541475612639710077817872953366973913",
                "315356322928239243626844894259748630801",
                "179386858639001927763330249514124088145",
                "80608196369949524394389360058744850440",
                "158569223671762209137945595180289044190",
                "162147575614427890156971511672168549409",
                "70150540875355371228928008329923136365",
                "216140370357140389066494044291736249624",
                "86661395278450309174613836306054714953",
                "223304581050060179345811325422971405359",
                "255251362765111924231262307454082981690",
                "26922350716785164804115266707303507715",
                "313294081620578311964998815516040096761",
                "29609873554155877203504207128374475040",
                "265231968927012168981703834787221318365",
                "30978765025026318365814098998774665876",
                "329319927834399607687965671394285462199",
                "62985721880421525107869850432464485764",
                "212466423433529676514959271093314703305",
                "255261796761029811401821501734968258095",
                "51490079170042863735796728899049198315",
                "182887505001783949237328026480763210971",
                "228671531714515860567679677987360605633",
                "97596741298478826109275208493891622768",
                "25246199757849480648197290611137252389",
                "192998638664675406804344099541064213192",
                "149129888741759159401882794631576624416",
                "253577098601286310115481668834459385148",
                "119343078600030819374247679989151190847",
                "285780108673008217816067288223088380931",
                "263676651150287264216454469044990799553",
                "337837545744554429636536539423119614868",
                "301324344439148555283264989436819253183",
                "80333221819948683208215070720021908185",
                "149355386983033748610012847887236342475",
                "7736953766303376353163905419547293969",
                "123724275784080966369449370051512913220",
                "257711831478306983943237338244797777420",
                "4014274978189768920460512784517249727",
                "19456293242112369828500531556152294888",
                "104224771145967303454685243837908315173",
                "247330915664440847929065595236073442648",
                "206539936919767930367323599653522704396",
                "203141854655876523304151881578188609227",
                "327497416971757977209295587293253294229",
                "216646251201622852962336126310567596127",
                "289420127945442698283838759188261169452",
                "144467368790156938769258639953769362905",
                "307640253641485040433778219066275335388",
                "200888283138086013335267079713014147273",
                "33873265389440847393720020357442342843",
                "36920098973554189375707456372358260164",
                "47848129116196880355321245709169681507",
                "54236460865494161502621236594256396341",
                "286129875463597172163817376986681064742",
                "164931622914370666196641095922603301378",
                "29512445699223418974712029448459673753",
                "256339508334011093457023149187027651893",
                "148761678017491760309203121976233933306",
                "52192883366406640538582258275113044688",
                "215527922660419332022048090833096902338",
                "157632586798696866587852400086081743",
                "164931622914370666196641095922603301378",
                "29512445699223418974712029448459673753",
                "256339508334011093457023149187027651893",
                "108587633537507210242609878158511307392",
                "9634910217485859148855329819411000421",
                "82840873863088459376450338917817713669",
                "79529057929122512792027465744532477738",
                "208751112320501723997017763516364220687",
                "56048887644944834556082681219761934166",
                "73957138796115325309144555863507271951",
                "325306381646412120167419046588390010935",
                "270309848634421970754345708934775288334",
                "249723644738034907817353784755943076121",
                "2143960560350679863354392987923290398",
                "163311160480306637138328547261663837584",
                "82874367332274718569398025614315270117",
                "37544530057850016347195233979168195899",
                "72849462762140050740729369804211171871",
                "178673454133732722274860962640604522065",
                "127412296631159428458286785062908091455",
                "218715227013814608052151629244720226350",
                "248741659959660836457872116382460128840",
                "184355393836450918718659736120874209405",
                "251751867567658714281748663193332330616",
                "127412296631159428458286785062908091455",
                "218715227013814608052151629244720226350",
                "332604640935789877989411685628805792353",
                "218819610255231702369958335535598207962"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-110601-85e89468",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/saitoha/libsixel/commit/bdbab09816eb9188429c37a50b97c5e66dfe5047",
        "target": {
            "file": "src/fromgif.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "83567981024149702125965533044073847590",
            "length": 1267
        },
        "id": "CVE-2026-110601-f9acf4cf",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/saitoha/libsixel/commit/bdbab09816eb9188429c37a50b97c5e66dfe5047",
        "target": {
            "file": "src/fromgif.c",
            "function": "gif_out_code"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:06:32Z"