CVE-2025-61146: Libsixel Memory Leak DoS Vulnerability

CVE-2025-61146 Overview

A memory leak vulnerability was discovered in saitoha libsixel versions up to v1.8.7. The vulnerability exists within the malloc_stub.c component and can lead to resource exhaustion when processing crafted input, potentially causing denial of service conditions on affected systems.

Critical Impact

Applications using libsixel for SIXEL graphics processing may experience memory exhaustion and service degradation when processing malicious input files.

Affected Products

• libsixel_project libsixel versions up to and including v1.8.7
• Applications utilizing libsixel for SIXEL graphics encoding/decoding
• Terminal emulators and image converters implementing libsixel

Discovery Timeline

• 2026-02-23 - CVE CVE-2025-61146 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2025-61146

Vulnerability Analysis

This vulnerability is classified as CWE-401: Missing Release of Memory after Effective Lifetime. The flaw resides in the memory allocation stub component (malloc_stub.c) of the libsixel library. When processing certain input files, the library fails to properly release allocated memory, resulting in a memory leak that accumulates over time or during repeated operations.

The vulnerability requires local access to exploit, meaning an attacker would need to either have local system access or convince a user to process a specially crafted file through an application using libsixel. While no authentication is required to trigger the vulnerability, the impact is limited to availability degradation through memory exhaustion.

Root Cause

The root cause stems from improper memory management in the malloc_stub.c component. Memory allocated during image processing operations is not properly freed under certain conditions, leading to gradual memory consumption. The issue was identified and reported by security researcher @optionGo through GitHub issue #207.

Attack Vector

The attack vector is local, requiring an attacker to provide a maliciously crafted input file to an application using libsixel. This could be achieved through:

1. Providing a crafted image file to a terminal emulator supporting SIXEL graphics
2. Processing malicious input through the img2sixel converter utility
3. Any application consuming untrusted SIXEL-encoded content

The patch introduces test cases to validate proper handling of problematic input:

 issue-200:
 	converters/img2sixel --7bit-mode -8 --invert --palette-type=auto --verbose tests/issue/200/POC_img2sixel_heap_buffer_overflow -o /dev/null
 
+issue-207: all
+	converters/img2sixel -h 50% -r lanczos3 -w 300px tests/issue/207/poc; test $$? = 255 -o $$? = 127
+
+issue-207-vexe:
+	CC=clang CFLAGS="-fsanitize=address -O0 -g -fno-omit-frame-pointer" tools/vexe ubuntu issue-207
+
 libsixel-libsixel-issue-73:
 	converters/img2sixel tests/issue/libsixel-libsixel/73/stbi_1561_poc.bin

Source: GitHub Commit Log for Libsixel

Detection Methods for CVE-2025-61146

Indicators of Compromise

• Gradual memory consumption increase in processes using libsixel
• Unexpected out-of-memory errors in terminal emulators or image processing applications
• System performance degradation when processing SIXEL graphics content

Detection Strategies

• Monitor memory usage patterns for applications utilizing libsixel libraries
• Implement memory profiling tools such as Valgrind or AddressSanitizer to detect leaks
• Check installed libsixel version against vulnerable versions (up to v1.8.7)
• Review application logs for memory allocation failures or resource exhaustion warnings

Monitoring Recommendations

• Configure system resource monitoring to alert on abnormal memory consumption
• Implement process-level memory limits for applications processing untrusted SIXEL content
• Deploy endpoint detection to identify repeated crashes or restarts of affected applications
• Monitor for presence of proof-of-concept files matching known patterns from the disclosed issue

How to Mitigate CVE-2025-61146

Immediate Actions Required

• Update libsixel to a patched version that includes commit e0ba6685262a3679cc5b9009c0c5b7dc8a3f262e
• Review applications in your environment that depend on libsixel for SIXEL graphics processing
• Limit exposure by restricting processing of untrusted SIXEL-encoded content
• Implement resource limits on processes using libsixel to contain potential memory exhaustion

Patch Information

The vulnerability has been addressed in the official libsixel repository. The fix is documented in GitHub Issue Report for Libsixel and implemented in commit e0ba6685262a3679cc5b9009c0c5b7dc8a3f262e. Organizations should update to the latest version of libsixel that includes this security fix.

Workarounds

• Implement memory limits using ulimit or cgroups for processes using libsixel
• Restrict SIXEL graphics processing to trusted input sources only
• Consider sandboxing applications that process untrusted SIXEL content
• Monitor and restart affected processes if memory consumption exceeds thresholds

# Configuration example - Limit memory for img2sixel process
ulimit -v 524288  # Set virtual memory limit to 512MB
img2sixel input.png -o output.sixel

# Alternative: Use cgroups to limit memory
cgcreate -g memory:/libsixel_limit
echo 536870912 > /sys/fs/cgroup/memory/libsixel_limit/memory.limit_in_bytes
cgexec -g memory:libsixel_limit img2sixel input.png -o output.sixel