What is the CVSS score of CVE-2026-33019?

CVE-2026-33019 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Libsixel are affected by CVE-2026-33019?

libsixel img2sixel versions 1.8.7 and earlier contain an integer overflow vulnerability that allows local users to crash the application or potentially access sensitive memory when processing…. A patch is available.

How to fix or mitigate CVE-2026-33019?

Within 24 hours: inventory systems running libsixel 1.8.7 or earlier and assess exposure in production environments. Within 7 days: update libsixel to version 1.8.7-r1 or later across all affected systems. Within 30 days: validate patched versions in non-production environments and document remediation completion.

Libsixel CVE-2026-33019

EUVD-2026-22742 HIGH

Out-of-bounds Read (CWE-125)

2026-04-14 security-advisories@github.com

Buffer Overflow Information Disclosure Libsixel

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

7.1 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 23, 2026 - 14:47 nvd

Patch available

Analysis Updated

Apr 16, 2026 - 05:56 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8.7-r1

Re-analysis Queued

Apr 15, 2026 - 20:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 22:41 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:22 euvd

EUVD-2026-22742

Analysis Generated

Apr 14, 2026 - 22:22 vuln.today

CVE Published

Apr 14, 2026 - 22:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow leading to an out-of-bounds heap read in the --crop option handling of img2sixel, where positive coordinates up to INT_MAX are accepted without overflow-safe bounds checking. In sixel_encoder_do_clip(), the expression clip_w + clip_x overflows to a large negative value when clip_x is INT_MAX, causing the bounds guard to be skipped entirely, and the unclamped coordinate is passed through sixel_frame_clip() to clip(), which computes a source pointer far beyond the image buffer and passes it to memmove(). An attacker supplying a specially crafted crop argument with any valid image can trigger an out-of-bounds read in the heap, resulting in a reliable crash and potential information disclosure. This issue has been fixed in version 1.8.7-r1.

AnalysisAI

Out-of-bounds heap read in libsixel img2sixel via integer overflow allows local attackers to crash the application and potentially leak sensitive memory contents when processing malicious --crop arguments with otherwise valid images. Affects libsixel 1.8.7 and earlier; patched in 1.8.7-r1. EPSS data not available, but exploitation requires local access with user interaction (CVSS AV:L/UI:R). No CISA KEV listing; no public exploit identified at time of analysis.

Technical ContextAI

libsixel is a SIXEL image format encoder/decoder library derived from kmiya's sixel implementation, commonly used for terminal graphics rendering. The vulnerability exists in the img2sixel command-line utility's --crop option parser within sixel_encoder_do_clip(). When processing crop coordinates, the code accepts positive integers up to INT_MAX without overflow-safe validation. The expression 'clip_w + clip_x' triggers signed integer overflow when clip_x approaches INT_MAX, wrapping to a large negative value that bypasses bounds checking guards. This corrupted coordinate propagates through sixel_frame_clip() to clip(), which calculates a source pointer extending far beyond the allocated heap buffer boundaries before passing it to memmove(). The root cause is CWE-125 (Out-of-bounds Read) enabled by inadequate integer overflow protection in arithmetic operations involving user-controlled crop coordinates.

RemediationAI

Vendor-released patch: libsixel version 1.8.7-r1 contains the fix for this integer overflow vulnerability. Users should immediately upgrade to libsixel 1.8.7-r1 or later, available from the official GitHub releases page at https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1. For environments where immediate patching is not feasible, implement input validation to reject --crop arguments with coordinates approaching INT_MAX, or restrict img2sixel usage to trusted input sources only. Organizations using libsixel in automated processing pipelines should sanitize crop parameters from untrusted sources and consider sandboxing img2sixel execution to contain potential information disclosure. Review the vendor security advisory at https://github.com/saitoha/libsixel/security/advisories/GHSA-c854-ffg9-g72c for additional technical details and upgrade guidance.