# CVE-2026-44637: saitoha libsixel integer overflow in SIXEL parser

Source: https://junglewise.ai/threats/cve-2026-44637-saitoha-libsixel-integer-overflow-in-sixel-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44637 · Severity: high · CVSS 7.1 · Published 2026-05-14

libsixel is a library used to encode and decode SIXEL images, a format often used to display graphics in terminal emulators and command-line tools. A vulnerability in how the library handles large image dimensions allows a specially crafted image file to corrupt the computer's memory. If a user opens a malicious image or uses a tool like img2sixel on a hostile file, it could cause the application to crash or allow an attacker to gain unauthorized control over the system.

Technologies: [Saitoha Libsixel](https://junglewise.ai/threats/technologies/libsixel). Vendors: [Saitoha](https://junglewise.ai/threats/vendors/saitoha).

## Quick answers

**Is CVE-2026-44637 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44637 being exploited in the wild.

**How severe is CVE-2026-44637?** High severity, with a CVSS score of 7.1, published 14 May 2026.

**Which products and versions are affected?** Saitoha Libsixel 0.11.0 to 1.8.7-r1.

**Is there a fix for CVE-2026-44637?** A patch was published on 2026-05-14: Fixed in version 1.8.7-r2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44637 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-44637?** Check whether you run Saitoha Libsixel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A signed integer overflow exists in the SIXEL parser's image-buffer doubling loop within `sixel_decode_raw_impl`. The variable `context->pos_x` can be incremented by `repeat_count` without sufficient upper-bound checks, eventually approaching `INT_MAX`. When `pos_x + repeat_count` overflows, the subsequent buffer resize check (`sx > image->width`) can be bypassed because the wrapped value appears smaller than the current width. This results in a large attacker-influenced offset being used for a heap write at `image->data[pos]`. The vulnerability is reachable via any application using `sixel_decode_raw` or `sixel_decode`, including the `img2sixel` utility. A fix is available in version 1.8.7-r2.

## Affected products

- saitoha libsixel 0.11.0 to 1.8.7-r1

## Timeline

- 2026-05-03: advisory: GitHub Security Advisory published by maintainer
- 2026-05-14: disclosed: CVE published to NVD
- 2026-05-14: patched: Fixed in version 1.8.7-r2

## References

- [https://github.com/saitoha/libsixel/security/advisories/GHSA-9jm7-77gr-qghv](https://github.com/saitoha/libsixel/security/advisories/GHSA-9jm7-77gr-qghv)

## Related threats

- [saitoha libsixel NULL pointer dereference in sixel_decode_raw](https://junglewise.ai/threats/cve-2026-44638-saitoha-libsixel-null-pointer-dereference-in-sixel-decode-raw)
- [saitoha libsixel heap buffer overflow in sixel_encode_highcolor](https://junglewise.ai/threats/cve-2026-44636-saitoha-libsixel-heap-buffer-overflow-in-sixel-encode-highcolor)
- [saitoha libsixel use-after-free in load_with_gdkpixbuf](https://junglewise.ai/threats/cve-2026-33023-saitoha-libsixel-use-after-free-in-load-with-gdkpixbuf)
- [saitoha libsixel use-after-free in sixel_encoder_encode_bytes](https://junglewise.ai/threats/cve-2026-33021-saitoha-libsixel-use-after-free-in-sixel-encoder-encode-bytes)
- [saitoha libsixel heap overflow in sixel_frame_convert_to_rgb888](https://junglewise.ai/threats/cve-2026-33020-saitoha-libsixel-heap-overflow-in-sixel-frame-convert-to-rgb888)