CVE-2026-110601: libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gifinitframe() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libsixelto a version that resolves this vulnerability.Fixed in 1:1.8.7-r2-1
Event History
Frequently Asked Questions
What conditions are required to trigger the flaw?
An attacker must get a crafted GIF processed by libsixel with a background color set. The GIF needs a small color table and a transparent-color index larger than the palette size.
Is remote exploitation implied by the available severity data?
No. The supplied vector is AV:L, indicating local attack vector, and UI:R indicates user interaction is required. The data does not identify a specific application or delivery path.
What is the likely impact if exploitation succeeds?
The out-of-bounds write can corrupt heap memory or cause a crash. The provided metrics indicate high integrity and availability impact, with no confidentiality impact.
Which versions are affected?
Affected versions are releases before 1.8.7-r1 and versions from 1.9.0 through 1.10.5. The data identifies 1.8.7-r1 as a release containing the referenced fix.