What is the CVSS score of CVE-2026-44638?

CVE-2026-44638 has a CVSS 3.1 base score of 2.5 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44638?

Yes, a patch is available for CVE-2026-44638. Update the affected software to the latest version immediately.

libsixel CVE-2026-44638

EUVD-2026-30411 LOW

NULL Pointer Dereference (CWE-476)

2026-05-14 GitHub_M

Denial Of Service Null Pointer Dereference Libsixel

2.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.5 LOW

AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

May 14, 2026 - 21:32 EUVD

Analysis Generated

May 14, 2026 - 21:18 vuln.today

CVE Published

May 14, 2026 - 19:59 nvd

LOW 2.5

DescriptionGitHub Advisory

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.

AnalysisAI

libsixel versions prior to 1.8.7-r2 crash on memory allocation failure in sixel_decode_raw and sixel_decode functions due to incorrect NULL pointer validation, allowing local attackers to trigger denial of service under low-memory conditions. The vulnerability affects any application using libsixel's public decoding APIs when system memory pressure causes malloc to fail.

Technical ContextAI

libsixel is a SIXEL encoder/decoder library that processes SIXEL graphics format data. SIXEL is a text-based graphics protocol commonly used in terminal emulators. The vulnerability exists in the sixel_decode_raw and sixel_decode functions, which allocate memory buffers for decoded image output. The root cause is CWE-476 (NULL Pointer Dereference): after calling malloc to allocate output buffers, the code incorrectly validates the allocation result by checking the address of the output parameter (which is a pointer passed by the caller and is always non-NULL) instead of checking the return value of malloc itself. When malloc returns NULL due to memory exhaustion, the null check passes incorrectly, and the function proceeds to dereference and write through the NULL pointer, causing a process crash.

RemediationAI

Upgrade libsixel to version 1.8.7-r2 or later, which includes the corrected NULL pointer validation in sixel_decode_raw and sixel_decode functions. For systems unable to immediately upgrade, no effective workaround exists at the library level since the vulnerability is intrinsic to the API implementation. Mitigation strategies include configuring memory limits via cgroups or ulimit to gracefully prevent malloc failures (trade-off: may cause legitimate out-of-memory errors to surface earlier), using memory monitoring tools to maintain sufficient headroom above libsixel's allocation requirements, or restricting libsixel API usage to trusted inputs within memory-constrained environments. Consult https://github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w for patch availability and release notes.