CVE-2026-44638
Description
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2026-44638.html
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2026-44638
Vendor advisory: security-advisories@github.com — https://github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | affected | |
| debian | bullseye | affected | |
| debian | forky | fixed | 1:1.8.7-r2-1 |
| debian | sid | fixed | 1:1.8.7-r2-1 |
| debian | trixie | affected | |
| sles | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| saitoha | libsixel | {"startIncluding":"1.0.0","endExcluding":"1.8.7-r2"} | 1.8.7-r2 |
References
CWEs
CWE-476 CWE-690
Verify integrity in audit chain (admin only). AS-IS.