CVE-2026-44638: saitoha libsixel NULL Pointer Dereference

Vulnerability summary

CVE-2026-44638 is a low (CVSS 2.5) NULL Pointer Dereference vulnerability in saitoha libsixel. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 1.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 14-05-2026
   PublishedVulnerability first disclosed.
2. 15-05-2026
   Last modifiedVulnerability information updated.

Description

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.

• CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.
• CWE-690Unchecked Return Value to NULL Pointer DereferenceThe product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.