Junglewise Threat Intelligence

CVE-2026-44638: saitoha libsixel NULL pointer dereference in sixel_decode_raw

CVE-2026-44638 · Severity: low · CVSS 2.5 · Published 2026-05-14

Technologies: Saitoha Libsixel. Vendors: Saitoha.

Executive brief

libsixel is a library used for encoding and decoding SIXEL graphics, a format for displaying images in terminal environments. A flaw in how the library handles memory allocation can cause applications using it to crash when the system runs low on memory. This results in a denial-of-service condition where the affected application stops functioning, though it does not appear to lead to data theft or unauthorized access.

Technical details

A vulnerability exists in the `sixel_decode_raw` and `sixel_decode` functions of libsixel due to an incorrect NULL check following a memory allocation call. The code incorrectly checks the address of the output parameter pointer instead of the value returned by the allocator. Consequently, if `sixel_allocator_malloc` fails and returns NULL, the check passes, and the function proceeds to dereference the NULL pointer during a write operation. This results in a denial of service (crash) when the library encounters memory pressure. The issue is fixed in version 1.8.7-r2 by correcting the pointer check logic.

Affected products

  • saitoha libsixel 1.0.0 to 1.8.7-r1

Timeline

  • 2026-05-03: advisory: GitHub Security Advisory published by maintainer
  • 2026-05-14: disclosed: CVE-2026-44638 published to NVD

References

Related threats