CVE-2026-44638: libsixel: NULL pointer dereference
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixeldecoderaw and sixeldecode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44638?
The severity of CVE-2026-44638 is categorized as moderate due to the potential for a NULL pointer dereference leading to application crashes.
How do I fix CVE-2026-44638?
To fix CVE-2026-44638, upgrade to libsixel version 1.8.7-r2 or later where the issue has been resolved.
What software is affected by CVE-2026-44638?
CVE-2026-44638 affects libsixel versions prior to 1.8.7-r2.
What happens if I don't address CVE-2026-44638?
Failing to address CVE-2026-44638 could result in application instability, leading to crashes during the use of the affected libsixel library.
Is CVE-2026-44638 related to any specific vulnerabilities in the code?
Yes, CVE-2026-44638 is related to improper NULL pointer checks after failed memory allocation in the libsixel library.