CVE-2026-44638: CWE-476: NULL Pointer Dereference in saitoha libsixel
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.
AI Analysis
Technical Summary
libsixel, a SIXEL encoder/decoder, contains a vulnerability in versions >= 1.0.0 and < 1.8.7-r2 where the functions sixel_decode_raw and sixel_decode perform an incorrect NULL check after memory allocation. Instead of checking the returned pointer from malloc, the code checks the address of the output parameter, which is always non-NULL. Consequently, if malloc fails and returns NULL, the functions proceed to write through a NULL pointer, causing a process crash. This results in a denial of service condition under low-memory scenarios. The vulnerability is fixed in version 1.8.7-r2.
Potential Impact
The vulnerability causes a denial of service by crashing the process that calls the affected libsixel functions when memory allocation fails. There is no impact on confidentiality or integrity. Exploitation requires a low-memory condition and local access due to the attack vector being local (AV:L).
Mitigation Recommendations
A fix is available in libsixel version 1.8.7-r2. Users should upgrade to this version or later to remediate the vulnerability. Patch status is confirmed by the vendor's versioning information. No additional mitigation is indicated.
CVE-2026-44638: CWE-476: NULL Pointer Dereference in saitoha libsixel
Description
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.
CVSS v3.1
Score 2.5low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
libsixel, a SIXEL encoder/decoder, contains a vulnerability in versions >= 1.0.0 and < 1.8.7-r2 where the functions sixel_decode_raw and sixel_decode perform an incorrect NULL check after memory allocation. Instead of checking the returned pointer from malloc, the code checks the address of the output parameter, which is always non-NULL. Consequently, if malloc fails and returns NULL, the functions proceed to write through a NULL pointer, causing a process crash. This results in a denial of service condition under low-memory scenarios. The vulnerability is fixed in version 1.8.7-r2.
Potential Impact
The vulnerability causes a denial of service by crashing the process that calls the affected libsixel functions when memory allocation fails. There is no impact on confidentiality or integrity. Exploitation requires a low-memory condition and local access due to the attack vector being local (AV:L).
Mitigation Recommendations
A fix is available in libsixel version 1.8.7-r2. Users should upgrade to this version or later to remediate the vulnerability. Patch status is confirmed by the vendor's versioning information. No additional mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-07T15:30:10.875Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a062b58ec166c07b00deb50
Added to database: 05/14/2026, 20:06:48 UTC
Last enriched: 05/14/2026, 21:08:30 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.