CVE-2026-44637
- Source
- https://cve.org/CVERecord?id=CVE-2026-44637
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44637.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-44637
- Aliases
-
- GHSA-9jm7-77gr-qghv
- Downstream
- Published
- 2026-05-14T20:02:32.034Z
- Modified
- 2026-07-08T08:09:36.537104469Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- libsixel: integer overflow in parser
- Details
-
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixeldecoderawimpl. context->posx grows by repeatcount on every sixel character with no upper bound check. Once posx approaches INTMAX, the expression "posx + repeat_count" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44637.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-190", "CWE-787" ] }- References