CVE-2026-33020

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33020", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T17:22:14.667Z", "datePublished": "2026-04-14T21:53:00.388Z", "dateUpdated": "2026-04-15T13:30:47.463Z"}, "containers": {"cna": {"title": "libsixel: Integer Overflow in write_png_to_file() leads to Heap-based Buffer Overflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/saitoha/libsixel/security/advisories/GHSA-2xgm-4x47-2x2p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-2xgm-4x47-2x2p"}, {"name": "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1", "tags": ["x_refsource_MISC"], "url": "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1"}], "affected": [{"vendor": "saitoha", "product": "libsixel", "versions": [{"version": "< 1.8.7-r1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T21:53:00.388Z"}, "descriptions": [{"lang": "en", "value": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow via sixel_frame_convert_to_rgb888() in frame.c, where allocation size and pointer offset computations for palettised images (PAL1, PAL2, PAL4) are performed using int arithmetic before casting to size_t. For images whose pixel count exceeds INT_MAX / 4, the overflow produces an undersized heap allocation for the conversion buffer and a negative pointer offset for the normalization sub-buffer, after which sixel_helper_normalize_pixelformat() writes the full image data starting from the invalid pointer, causing massive heap corruption confirmed by ASAN. An attacker providing a specially crafted large palettised PNG can corrupt the heap of the victim process, resulting in a reliable crash and potential arbitrary code execution.\nThis issue has been fixed in version 1.8.7-r1."}], "source": {"advisory": "GHSA-2xgm-4x47-2x2p", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-2xgm-4x47-2x2p", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T13:30:43.489988Z", "id": "CVE-2026-33020", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T13:30:47.463Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33020", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T13:30:43.489988Z"}}}], "references": [{"url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-2xgm-4x47-2x2p", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T13:30:37.462Z"}}], "cna": {"title": "libsixel: Integer Overflow in write_png_to_file() leads to Heap-based Buffer Overflow", "source": {"advisory": "GHSA-2xgm-4x47-2x2p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "saitoha", "product": "libsixel", "versions": [{"status": "affected", "version": "< 1.8.7-r1"}]}], "references": [{"url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-2xgm-4x47-2x2p", "name": "https://github.com/saitoha/libsixel/security/advisories/GHSA-2xgm-4x47-2x2p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1", "name": "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow via sixel_frame_convert_to_rgb888() in frame.c, where allocation size and pointer offset computations for palettised images (PAL1, PAL2, PAL4) are performed using int arithmetic before casting to size_t. For images whose pixel count exceeds INT_MAX / 4, the overflow produces an undersized heap allocation for the conversion buffer and a negative pointer offset for the normalization sub-buffer, after which sixel_helper_normalize_pixelformat() writes the full image data starting from the invalid pointer, causing massive heap corruption confirmed by ASAN. An attacker providing a specially crafted large palettised PNG can corrupt the heap of the victim process, resulting in a reliable crash and potential arbitrary code execution.\nThis issue has been fixed in version 1.8.7-r1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T21:53:00.388Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33020", "state": "PUBLISHED", "dateUpdated": "2026-04-15T13:30:47.463Z", "dateReserved": "2026-03-17T17:22:14.667Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-14T21:53:00.388Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libsixel", "vendor": "saitoha", "versions": [{"status": "affected", "version": "< 1.8.7-r1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E16EAA6A-544F-4D16-829D-1B7C9979EA6A", "versionEndExcluding": "1.8.7-r1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow via sixel_frame_convert_to_rgb888() in frame.c, where allocation size and pointer offset computations for palettised images (PAL1, PAL2, PAL4) are performed using int arithmetic before casting to size_t. For images whose pixel count exceeds INT_MAX / 4, the overflow produces an undersized heap allocation for the conversion buffer and a negative pointer offset for the normalization sub-buffer, after which sixel_helper_normalize_pixelformat() writes the full image data starting from the invalid pointer, causing massive heap corruption confirmed by ASAN. An attacker providing a specially crafted large palettised PNG can corrupt the heap of the victim process, resulting in a reliable crash and potential arbitrary code execution.\nThis issue has been fixed in version 1.8.7-r1."}, {"lang": "es", "value": "libsixel es una implementaci\u00f3n de codificador/decodificador SIXEL derivada de sixel de kmiya. Las versiones 1.8.7 y anteriores contienen un desbordamiento de entero que conduce a un desbordamiento de b\u00fafer de mont\u00f3n a trav\u00e9s de sixel_frame_convert_to_rgb888() en frame.c, donde los c\u00e1lculos de tama\u00f1o de asignaci\u00f3n y desplazamiento de puntero para im\u00e1genes paletizadas (PAL1, PAL2, PAL4) se realizan utilizando aritm\u00e9tica de enteros antes de la conversi\u00f3n a size_t. Para im\u00e1genes cuyo recuento de p\u00edxeles excede INT_MAX / 4, el desbordamiento produce una asignaci\u00f3n de mont\u00f3n de tama\u00f1o insuficiente para el b\u00fafer de conversi\u00f3n y un desplazamiento de puntero negativo para el sub-b\u00fafer de normalizaci\u00f3n, despu\u00e9s de lo cual sixel_helper_normalize_pixelformat() escribe los datos completos de la imagen comenzando desde el puntero inv\u00e1lido, causando una corrupci\u00f3n masiva del mont\u00f3n confirmada por ASAN. Un atacante que proporciona un PNG paletizado grande especialmente dise\u00f1ado puede corromper el mont\u00f3n del proceso v\u00edctima, lo que resulta en un fallo fiable y una potencial ejecuci\u00f3n de c\u00f3digo arbitrario. Este problema ha sido solucionado en la versi\u00f3n 1.8.7-r1."}], "id": "CVE-2026-33020", "lastModified": "2026-07-25T11:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33020", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T13:30:43.489988Z", "version": "2.0.3"}}]}, "published": "2026-04-14T22:16:30.543", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-2xgm-4x47-2x2p"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-2xgm-4x47-2x2p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-190"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libsixel: libsixel: Arbitrary code execution via crafted palettised PNG image processing", "id": "2458500", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458500"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in libsixel. An integer overflow vulnerability in the `sixel_frame_convert_to_rgb888()` function can lead to a heap buffer overflow when processing specially crafted large palettised PNG images. An attacker can exploit this by providing a malicious image, which causes heap corruption in the victim's process. This can result in a denial of service due to a reliable crash and potentially allow for arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "Avoid processing untrusted or suspicious image files with applications that use libsixel. If possible, restrict the sources of images processed by affected applications to trusted origins."}, "name": "CVE-2026-33020", "public_date": "2026-04-14T21:53:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33020\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33020\nhttps://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1\nhttps://github.com/saitoha/libsixel/security/advisories/GHSA-2xgm-4x47-2x2p"], "statement": "Important: A heap buffer overflow flaw in libsixel, triggered by processing specially crafted palettised PNG images, can lead to denial of service and potentially arbitrary code execution. This vulnerability requires user interaction, as an attacker must provide a malicious image to the victim's process. Red Hat products utilizing libsixel for image processing may be affected if they handle untrusted image input.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.8.7-r1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "libsixel", "source": "cna", "vendor": "saitoha"}, "product": "libsixel", "vendor": "saitoha"}], "analysis": {"en": {"generated_at": "2026-04-14T23:25:11.709930+00:00", "value": {"mitigation_remediation": ["Upgrade libsixel to version 1.8.7-r1 or later", "If an upgrade is not immediately possible, validate or reject PNG files whose pixel count (PAL1, PAL2, PAL4) would cause a buffer allocation exceeding INT_MAX/4 before processing", "Apply input size or format restrictions in the application layer, or run image processing in a sandboxed environment to contain any potential heap corruption"], "summary": {"action": "Immediate Patch", "impact": "Arbitrary code execution via heap corruption"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the libsixel library produced by saitoha. All releases up to and including version 1.8.7 are susceptible. The issue was fixed in version 1.8.7\u2011r1.", "description_and_impact": "libsixel implements SIXEL encoding/decoding and contains an integer overflow in sixel_frame_convert_to_rgb888(). The overflow occurs when calculating allocation sizes for palettised images using int arithmetic. When the pixel count exceeds INT_MAX/4, the conversion buffer is undersized and a negative pointer offset is produced. The subsequent normalization function writes the entire image data starting from this invalid location, causing massive heap corruption. An attacker that can supply a crafted large palettised PNG can trigger the overflow, crash the process, and potentially execute arbitrary code.", "risk_and_exploitability": "The CVSS score of 7.1 indicates a high severity of the exploit. EPSS data is not available, and the vulnerability is not listed in CISA\u2019s KEV catalog, but the nature of the heap buffer overflow and reliance on user-supplied PNGs suggest a realistic exploitation path. Inferred attack vector: an adversary can deliver a specially crafted large palettised PNG to any process that uses libsixel to decode or encode images, leading to reliable crashes and a strong possibility of arbitrary code execution if the environment allows execution of malicious payloads."}}}}, "created": "2026-04-15T13:48:23.620670+00:00", "updated": "2026-04-15T14:31:57.030157+00:00", "vendors": ["saitoha", "saitoha$PRODUCT$libsixel"]}