libsixel CVE-2026-44638

Exploitation requires concurrent low-memory conditions (malloc returning NULL) at the moment sixel_decode_raw or sixel_decode is invoked with untrusted SIXEL data. The vulnerability is local-only (AV:L from CVSS vector); remote exploitation would require a remote attacker to trigger decoding on a local system via an application that accepts SIXEL input over the network (e.g., a web terminal or SSH session). High attack complexity (AC:H) is inherent because reliably triggering memory exhaustion alongside API invocation is difficult; systems with adequate memory will not encounter this path. User interaction (UI:R) is required, meaning the user must explicitly open or process a SIXEL image or the application must automatically decode untrusted SIXEL content. No special product configuration is required-the vulnerable code path exists in default libsixel builds. The limiting factors are the local-only attack vector and the practical difficulty of engineering simultaneous memory exhaustion.

This vulnerability presents low real-world risk despite its denial-of-service classification. The CVSS 2.5 score reflects the limited practical impact: exploitation requires local access (AV:L), high attack complexity (AC:H), no privileges (PR:N), and user interaction (UI:R), meaning an attacker must already have local system access and trigger the vulnerable code path under specific memory-constrained conditions. The EPSS score is not provided, but exploitation likelihood is constrained by the requirement to engineer memory exhaustion simultaneously with libsixel API invocation-a difficult practical scenario outside controlled environments. No KEV status or public POC is indicated, suggesting no active exploitation in the wild. The vulnerability is primarily a reliability concern rather than a security threat; it is more likely to occur as a crash from legitimate low-memory conditions (resource exhaustion, swap depletion) than from deliberate attack. Systems with sufficient memory headroom or memory management policies will rarely encounter this failure path.

A local attacker with command-line or application-level access to a system running libsixel-dependent software (e.g., a terminal emulator or image viewer) supplies a SIXEL-formatted image to be decoded while the system is under memory pressure. When the libsixel decoder attempts to allocate buffers for the image data and malloc fails due to exhausted memory, the incorrect NULL check allows the function to proceed and write through a NULL pointer, crashing the decoding process and potentially rendering the application or service unusable.