CVE-2026-44637

{
  "id": "CVE-2026-44637",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-14T20:17:08.847",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From  to 1.8.7-r1, a signed integer overflow in the SIXEL parser's image-buffer doubling loop can lead to an out-of-bounds heap write in sixel_decode_raw_impl. context->pos_x grows by repeat_count on every sixel character with no upper bound check. Once pos_x approaches INT_MAX, the expression \"pos_x + repeat_count\" used to size the image buffer overflows signed int. Depending on how the overflow wraps, the resize check that should reject oversized buffers can be bypassed, after which a subsequent write computes a large attacker-influenced offset into image->data and writes past the allocation. Reachable from any caller that decodes attacker-supplied SIXEL data, including img2sixel. This vulnerability is fixed in 1.8.7-r2."
    },
    {
      "lang": "es",
      "value": "libsixel es una implementación de codificador/decodificador SIXEL derivada de sixel de kmiya. Hasta la versión 1.8.7-r1, un desbordamiento de entero con signo en el bucle de duplicación del búfer de imagen del analizador SIXEL puede provocar una escritura fuera de límites en el heap en sixel_decode_raw_impl. context  ->  pos_x crece por repeat_count en cada carácter sixel sin una comprobación de límite superior. Una vez que pos_x se acerca a INT_MAX, la expresión ’pos_x + repeat_count’ utilizada para dimensionar el búfer de imagen desborda el entero con signo. Dependiendo de cómo se envuelva el desbordamiento, la comprobación de redimensionamiento que debería rechazar los búferes sobredimensionados puede ser eludida, después de lo cual una escritura posterior calcula un gran desplazamiento influenciado por el atacante en image  ->  data y escribe más allá de la asignación. Alcanzable desde cualquier llamador que decodifique datos SIXEL proporcionados por el atacante, incluyendo img2sixel. Esta vulnerabilidad está corregida en 1.8.7-r2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "saitoha",
          "product": "libsixel",
          "versions": [
            {
              "version": ">= 0.11.0, < 1.8.7-r2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-15T13:35:42.115758Z",
          "id": "CVE-2026-44637",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "0.11.0",
              "versionEndExcluding": "1.8.7-r2",
              "matchCriteriaId": "7E82CD3A-0E58-4567-81F9-C7010DFE4D1E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-9jm7-77gr-qghv",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-9jm7-77gr-qghv",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}