Saitoha Libsixel vulnerabilities
49 vulnerabilities
Known vulnerabilities in Saitoha Libsixel, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-110601debianlibsixel+2
EPSS score0.17%
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.CVE-2018-19761debianlibsixel+2EPSS score0.68%
There is an illegal address access at fromsixel.c (function: sixel_decode_raw_impl) in libsixel 1.8.2 that will cause a denial of service.CVE-2018-19762debianlibsixel+2EPSS score0.82%
There is a heap-based buffer overflow at fromsixel.c (function: image_buffer_resize) in libsixel 1.8.2 that will cause a denial of service or possibly unspecified other impact.CVE-2018-19756debianlibsixel+2EPSS score0.68%
There is a heap-based buffer over-read at stb_image.h (function: stbi__tga_load) in libsixel 1.8.2 that will cause a denial of service.CVE-2018-19763debianlibsixel+2EPSS score0.68%
There is a heap-based buffer over-read at writer.c (function: write_png_to_file) in libsixel 1.8.2 that will cause a denial of service.CVE-2018-19757debianlibsixel+2EPSS score0.86%
There is a NULL pointer dereference at function sixel_helper_set_additional_message (status.c) in libsixel 1.8.2 that will cause a denial of service.CVE-2018-19759debianlibsixel+2EPSS score0.68%
There is a heap-based buffer over-read at stb_image_write.h (function: stbi_write_png_to_mem) in libsixel 1.8.2 that will cause a denial of service.CVE-2018-14072debianlibsixel+2EPSS score1.44%
libsixel 1.8.1 has a memory leak in sixel_decoder_decode in decoder.c, image_buffer_resize in fromsixel.c, and sixel_decode_raw in fromsixel.c.CVE-2018-14073debianlibsixel+2EPSS score1.44%
libsixel 1.8.1 has a memory leak in sixel_allocator_new in allocator.c.CVE-2021-46700debianlibsixel+2EPSS score0.95%
In libsixel 1.8.6, sixel_encoder_output_without_macro (called from sixel_encoder_encode_frame in encoder.c) has a double free.CVE-2025-61146debianlibsixel+2EPSS score0.13%
saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.CVE-2025-9300debianlibsixel+3EPSS score0.25%
A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.CVE-2020-21677debianlibsixel+2EPSS score0.90%
A heap-based buffer overflow in the sixel_encoder_output_without_macro function in encoder.c of Libsixel 1.8.4 allows attackers to cause a denial of service (DOS) via converting a crafted PNG file into Sixel format.CVE-2020-21547debianlibsixel+2EPSS score1.06%
Libsixel 1.8.2 contains a heap-based buffer overflow in the dither_func_fs function in tosixel.c.CVE-2020-21048debianlibsixel+2EPSS score1.38%
An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.CVE-2020-21548debianlibsixel+2EPSS score1.06%
Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel_encode_highcolor function in tosixel.c.CVE-2020-21050debianlibsixel+2EPSS score1.55%
Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c.CVE-2020-21049debianlibsixel+2EPSS score1.38%
An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.CVE-2020-19668debianlibsixel+2EPSS score0.86%
Unverified indexs into the array lead to out of bound access in the gif_out_code function in fromgif.c in libsixel 1.8.6.CVE-2020-11721debianlibsixel+2EPSS score0.94%
load_png in loader.c in libsixel.a in libsixel 1.8.6 has an uninitialized pointer leading to an invalid call to free, which can cause a denial of service.