Libsixel CVE-2026-33019

Local attacker provides crafted image file to victim who runs img2sixel with --crop option specifying positive integer coordinates near INT_MAX. Victim must execute the command locally. Affects libsixel versions ≤1.8.7.

Real-world exploitation risk is moderate-to-low despite the 7.1 CVSS score. The attack vector is local (AV:L) requiring an attacker to supply malicious --crop arguments to a victim who must actively process an image file (UI:R - user interaction required), significantly constraining the threat model compared to remotely exploitable vulnerabilities. The CVSS vector indicates no privileges required (PR:N) but mandates user participation, typical of command-line tool exploitation scenarios. Successful exploitation yields high confidentiality impact (C:H) through potential memory disclosure and high availability impact (A:H) via reliable crash, but no integrity impact (I:N). No CISA KEV listing confirms this is not observed in active exploitation campaigns. EPSS probability data is unavailable, but the local-only attack surface, requirement for social engineering to trick users into processing attacker-controlled crop parameters, and limited scope (S:U - unchanged scope) suggest this is lower priority than network-accessible vulnerabilities. Primary risk exists in automated image processing pipelines where untrusted crop parameters might be accepted, or in shared computing environments where local attackers have physical or session access.

An attacker crafts a malicious command targeting a system administrator or automated image processing service, instructing them to convert a legitimate image file using img2sixel with a --crop argument specifying a malicious x-coordinate near INT_MAX (e.g., --crop=2147483647:0:100:100). When the victim executes the command, the integer overflow in sixel_encoder_do_clip() causes memmove() to read from unintended heap memory regions, crashing the application and potentially exposing sensitive data from adjacent memory allocations through core dumps or error messages. In shared hosting or multi-user environments, local attackers with shell access could exploit this to crash services or extract memory contents from processes running with elevated privileges.