CVE-2026-110601: libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gifinitframe() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the flaw?
An attacker must get a crafted GIF processed by libsixel with a background color set. The GIF needs a small color table and a transparent-color index larger than the palette size.
Is remote exploitation implied by the available severity data?
No. The supplied vector is AV:L, indicating local attack vector, and UI:R indicates user interaction is required. The data does not identify a specific application or delivery path.
What is the likely impact if exploitation succeeds?
The out-of-bounds write can corrupt heap memory or cause a crash. The provided metrics indicate high integrity and availability impact, with no confidentiality impact.
Which versions are affected?
Affected versions are releases before 1.8.7-r1 and versions from 1.9.0 through 1.10.5. The data identifies 1.8.7-r1 as a release containing the referenced fix.