Is CVE-2026-44638 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44638 being exploited in the wild.

How severe is CVE-2026-44638?

Low severity, with a CVSS score of 2.5, published 14 May 2026.

Which products and versions are affected?

Saitoha Libsixel 1.0.0 to 1.8.7-r1.

Is there a fix for CVE-2026-44638?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44638 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-44638?

Check whether you run Saitoha Libsixel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44638: saitoha libsixel NULL pointer dereference in sixel_decode_raw

CVE-2026-44638 · Severity: low · CVSS 2.5 · Published 2026-05-14

libsixel is a library used for encoding and decoding SIXEL graphics, a format for displaying images in terminal environments. A flaw in how the library handles memory allocation can cause applications using it to crash when the system runs low on memory. This results in a denial-of-service condition where the affected application stops functioning, though it does not appear to lead to data theft or unauthorized access.

Technologies: Saitoha Libsixel. Vendors: Saitoha.

Quick answers

Is CVE-2026-44638 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44638 being exploited in the wild.
How severe is CVE-2026-44638?: Low severity, with a CVSS score of 2.5, published 14 May 2026.
Which products and versions are affected?: Saitoha Libsixel 1.0.0 to 1.8.7-r1.
Is there a fix for CVE-2026-44638?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44638 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-44638?: Check whether you run Saitoha Libsixel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the `sixel_decode_raw` and `sixel_decode` functions of libsixel due to an incorrect NULL check following a memory allocation call. The code incorrectly checks the address of the output parameter pointer instead of the value returned by the allocator. Consequently, if `sixel_allocator_malloc` fails and returns NULL, the check passes, and the function proceeds to dereference the NULL pointer during a write operation. This results in a denial of service (crash) when the library encounters memory pressure. The issue is fixed in version 1.8.7-r2 by correcting the pointer check logic.

Affected products

saitoha libsixel 1.0.0 to 1.8.7-r1

Timeline

2026-05-03: advisory: GitHub Security Advisory published by maintainer
2026-05-14: disclosed: CVE-2026-44638 published to NVD

References

https://github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.