What is the CVSS score of CVE-2026-33020?

CVE-2026-33020 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Libsixel are affected by CVE-2026-33020?

CVE-2026-33020 is a heap buffer overflow in libsixel image processing library affecting versions 1.8.7 and earlier, enabling local attackers to execute arbitrary code when processing specially…. A patch is available.

How to fix or mitigate CVE-2026-33020?

Within 24 hours: Identify all systems running libsixel ≤1.8.7 using package managers (rpm -q libsixel, dpkg -l libsixel, etc.) and document exposure scope. Within 7 days: Apply vendor-released patch to libsixel version 1.8.7-r1 across all affected systems; verify installation with version check (libsixel-config --version). Within 30 days: Implement input validation controls restricting image processing to trusted sources and establish baseline for secure image handling procedures.

Libsixel CVE-2026-33020

EUVD-2026-22744 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-14 security-advisories@github.com

Heap Overflow Buffer Overflow RCE Libsixel

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.1 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 23, 2026 - 14:47 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:56 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8.7-r1

Analysis Generated

Apr 14, 2026 - 22:41 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:22 euvd

EUVD-2026-22744

Analysis Generated

Apr 14, 2026 - 22:22 vuln.today

CVE Published

Apr 14, 2026 - 22:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow via sixel_frame_convert_to_rgb888() in frame.c, where allocation size and pointer offset computations for palettised images (PAL1, PAL2, PAL4) are performed using int arithmetic before casting to size_t. For images whose pixel count exceeds INT_MAX / 4, the overflow produces an undersized heap allocation for the conversion buffer and a negative pointer offset for the normalization sub-buffer, after which sixel_helper_normalize_pixelformat() writes the full image data starting from the invalid pointer, causing massive heap corruption confirmed by ASAN. An attacker providing a specially crafted large palettised PNG can corrupt the heap of the victim process, resulting in a reliable crash and potential arbitrary code execution. This issue has been fixed in version 1.8.7-r1.

AnalysisAI

Heap buffer overflow in libsixel 1.8.7 and earlier allows local attackers to achieve arbitrary code execution by providing a maliciously crafted large palettised PNG image that triggers integer overflow in RGB888 conversion routines. The vulnerability requires user interaction to process the malicious image but no authentication. EPSS data not available; no public exploit identified at time of analysis, though the technical details in the advisory provide sufficient information for weaponization. Vendor-released patch: version 1.8.7-r1.

Technical ContextAI

libsixel is a SIXEL encoder/decoder library for terminal graphics, derived from kmiya's sixel implementation. The vulnerability (CWE-122: Heap-based Buffer Overflow) occurs in sixel_frame_convert_to_rgb888() within frame.c during conversion of palettised image formats (PAL1, PAL2, PAL4) to RGB888. The root cause is unsafe integer arithmetic: allocation size and pointer offset calculations use signed int types before casting to size_t. For images with pixel counts exceeding INT_MAX/4 (approximately 536 million pixels), integer overflow produces a severely undersized heap buffer allocation. The subsequent normalization operation in sixel_helper_normalize_pixelformat() computes a negative pointer offset, causing writes to begin at an invalid memory location. This results in massive out-of-bounds writes of full image data into uncontrolled heap regions, confirmed by AddressSanitizer during security testing. The vulnerability affects the core image processing pipeline and impacts any application using libsixel to decode untrusted palettised images.

RemediationAI

Upgrade to libsixel version 1.8.7-r1 or later, which contains fixes for the integer overflow and heap buffer overflow vulnerabilities. The patched release is available from the official GitHub repository at https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1. Organizations unable to immediately upgrade should implement input validation to reject or sanitize palettised PNG files with excessive dimensions (pixel count approaching or exceeding 536 million pixels) before processing with libsixel. Consider disabling processing of untrusted palettised images or implementing sandboxing for image conversion operations. Review all applications using libsixel dependencies and update build configurations to link against the patched version. For containerized or packaged deployments, update base images and dependency manifests to pull version 1.8.7-r1 or later. Consult the GitHub security advisory GHSA-2xgm-4x47-2x2p for additional context and vendor guidance.