CVE-2026-110601

Deferred Deferred - Pending Action

Heap Out-of-Bounds Write in libsixel GIF Processing

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110601

EUVD

EUVD-2026-101229

Affected Vendors & Products

Vendor	Product	Version / Range
saitoha	libsixel	0
saitoha	libsixel	1.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-110601 is a heap out-of-bounds write vulnerability in the libsixel library affecting versions before 1.8.7-r1 and 1.9.0 through 1.10.5. The issue occurs in the gif_init_frame() function in src/fromgif.c where the transparent color index from a GIF file is not validated against the palette size. Attackers can craft a GIF with a small color table and a large transparent index, causing the library to write data beyond the allocated palette buffer when processing the background color. This leads to heap corruption or application crashes.

Detection Guidance

To detect this vulnerability, check the installed version of libsixel on your system. Run: libsixel-config --version or pkg-config --modversion libsixel. If the version is before 1.8.7-r1 or between 1.9.0 and 1.10.5, the system is vulnerable.

Impact Analysis

This vulnerability can lead to denial-of-service conditions, application crashes, or potential arbitrary code execution if exploited. Users processing malicious GIF files with vulnerable libsixel versions may experience system instability, data corruption, or unexpected behavior in applications relying on the library for image processing.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks or memory corruption in applications processing GIF images. Such disruptions may lead to service unavailability or data processing interruptions, which could violate availability requirements under GDPR Article 32 or HIPAA Security Rule integrity principles. However, no direct evidence links this specific flaw to data breaches or unauthorized access.

Mitigation Strategies

Upgrade libsixel to version 1.8.7-r1 or later. If using a package manager, run: sudo apt-get update && sudo apt-get install libsixel1 or equivalent for your distribution. Avoid processing untrusted GIF files until patched.

Hi! I’m here to help you understand CVE-2026-110601. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70