CVE-2026-110601
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF
saitoha libsixel
CVSS
5.8MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 20 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.8.7-r1libsixelCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.
Text from CVE List
Affected versions 2
- libsixelaffected: all versions before 1.8.7-r1CVE List
- libsixelaffected: 1.9.0 through 1.10.5CVE List
References 7
- github.com/saitoha/libsixel/commit/bdbab09816eb9188429c37a50b97c5e66dfe5047Fixvia CVE List
- github.com/saitoha/libsixel/releases/tag/v1.8.7-r1Fixvia CVE List
- hackmd.io/@haind-pwn/libsixel-gif-transparent-index-oob-writeAdvisoryvia CVE List
- vulncheck.com/advisories/libsixel-before-1.8.7-r1-and-1.9.0-through-1.10.5-heap-out-of-bounds-write-via-gifAdvisoryvia CVE List
- github.com/saitoha/libsixel/issues/220Exploitvia CVE List
- github.com/saitoha/libsixel/blob/v1.8.7/src/fromgif.c#L182-L248Referencevia CVE List
- github.com/libsixel/libsixel/blob/v1.10.5/src/fromgif.c#L219-L240Referencevia CVE List