Report: CVE-2026-44637 - libsixel: integer overflow in parser - Complete Guide

Report: CVE-2026-44637 - libsixel: integer overflow in parser - Complete Guide

CVE ID :CVE-2026-44637 Published : May 14, 2026, 8:02 p.m. | 23 minutes ago Description :libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression

CVE Details

Published
May 14, 2026