# CVE-2026-44638: saitoha libsixel NULL pointer dereference in sixel_decode_raw

Source: https://junglewise.ai/threats/cve-2026-44638-saitoha-libsixel-null-pointer-dereference-in-sixel-decode-raw  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44638 · Severity: low · CVSS 2.5 · Published 2026-05-14

libsixel is a library used for encoding and decoding SIXEL graphics, a format for displaying images in terminal environments. A flaw in how the library handles memory allocation can cause applications using it to crash when the system runs low on memory. This results in a denial-of-service condition where the affected application stops functioning, though it does not appear to lead to data theft or unauthorized access.

Technologies: [Saitoha Libsixel](https://junglewise.ai/threats/technologies/libsixel). Vendors: [Saitoha](https://junglewise.ai/threats/vendors/saitoha).

## Quick answers

**Is CVE-2026-44638 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44638 being exploited in the wild.

**How severe is CVE-2026-44638?** Low severity, with a CVSS score of 2.5, published 14 May 2026.

**Which products and versions are affected?** Saitoha Libsixel 1.0.0 to 1.8.7-r1.

**Is there a fix for CVE-2026-44638?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44638 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-44638?** Check whether you run Saitoha Libsixel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the `sixel_decode_raw` and `sixel_decode` functions of libsixel due to an incorrect NULL check following a memory allocation call. The code incorrectly checks the address of the output parameter pointer instead of the value returned by the allocator. Consequently, if `sixel_allocator_malloc` fails and returns NULL, the check passes, and the function proceeds to dereference the NULL pointer during a write operation. This results in a denial of service (crash) when the library encounters memory pressure. The issue is fixed in version 1.8.7-r2 by correcting the pointer check logic.

## Affected products

- saitoha libsixel 1.0.0 to 1.8.7-r1

## Timeline

- 2026-05-03: advisory: GitHub Security Advisory published by maintainer
- 2026-05-14: disclosed: CVE-2026-44638 published to NVD

## References

- [https://github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w](https://github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w)

## Related threats

- [saitoha libsixel integer overflow in SIXEL parser](https://junglewise.ai/threats/cve-2026-44637-saitoha-libsixel-integer-overflow-in-sixel-parser)
- [saitoha libsixel heap buffer overflow in sixel_encode_highcolor](https://junglewise.ai/threats/cve-2026-44636-saitoha-libsixel-heap-buffer-overflow-in-sixel-encode-highcolor)
- [saitoha libsixel use-after-free in load_with_gdkpixbuf](https://junglewise.ai/threats/cve-2026-33023-saitoha-libsixel-use-after-free-in-load-with-gdkpixbuf)
- [saitoha libsixel use-after-free in sixel_encoder_encode_bytes](https://junglewise.ai/threats/cve-2026-33021-saitoha-libsixel-use-after-free-in-sixel-encoder-encode-bytes)
- [saitoha libsixel heap overflow in sixel_frame_convert_to_rgb888](https://junglewise.ai/threats/cve-2026-33020-saitoha-libsixel-heap-overflow-in-sixel-frame-convert-to-rgb888)