CVE-2026-33019: libsixel Buffer Overflow Vulnerability

CVE-2026-33019 Overview

CVE-2026-33019 is an integer overflow vulnerability in libsixel, a SIXEL encoder/decoder implementation derived from kmiya's sixel. The vulnerability exists in the --crop option handling of the img2sixel tool, where positive coordinate values up to INT_MAX are accepted without overflow-safe bounds checking. When exploited, this flaw allows an attacker to trigger an out-of-bounds heap read, potentially leading to application crashes and information disclosure.

Critical Impact

An attacker can supply a specially crafted crop argument with any valid image to trigger an out-of-bounds read in the heap, resulting in a reliable crash (denial of service) and potential information disclosure from heap memory.

Affected Products

• libsixel versions 1.8.7 and prior
• img2sixel tool (bundled with libsixel)
• Applications utilizing libsixel for SIXEL encoding/decoding

Discovery Timeline

• 2026-04-14 - CVE CVE-2026-33019 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-33019

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read), triggered by an integer overflow condition in the crop parameter processing logic. The flaw requires local access and user interaction, where a victim must process a malicious crop argument. Successful exploitation can lead to disclosure of sensitive heap memory contents and denial of service through application crashes.

The vulnerability specifically affects the sixel_encoder_do_clip() function, where arithmetic operations on crop coordinates are performed without adequate overflow protection.

Root Cause

The root cause lies in the insufficient bounds checking of the --crop option parameters in img2sixel. The application accepts positive coordinate values up to INT_MAX without implementing overflow-safe arithmetic checks. When the expression clip_w + clip_x is computed with clip_x set to INT_MAX, an integer overflow occurs, causing the result to wrap around to a large negative value. This negative value bypasses the bounds guard entirely, allowing unclamped coordinates to propagate through the call chain.

Attack Vector

The attack vector is local, requiring user interaction. An attacker must convince a victim to process an image using img2sixel with a specially crafted --crop argument. The attack flow proceeds as follows:

1. The attacker supplies a crop coordinate with clip_x set to INT_MAX
2. In sixel_encoder_do_clip(), the expression clip_w + clip_x overflows to a large negative value
3. The bounds guard comparison fails due to the unexpected negative result
4. The unclamped coordinate passes through sixel_frame_clip() to the clip() function
5. clip() computes a source pointer that points far beyond the allocated image buffer
6. This out-of-bounds pointer is passed to memmove(), causing a read from invalid heap memory
7. The operation results in either a crash or disclosure of heap memory contents

Detection Methods for CVE-2026-33019

Indicators of Compromise

• Unexpected crashes of img2sixel or applications using libsixel with segmentation faults
• Core dumps showing out-of-bounds memory access in sixel_encoder_do_clip() or related functions
• Unusual --crop arguments with extremely large coordinate values (near INT_MAX)
• Memory access violations reported by address sanitizers or similar tools

Detection Strategies

• Monitor for img2sixel invocations with suspicious crop parameters containing values near 2147483647 (INT_MAX)
• Deploy application crash monitoring for libsixel-dependent applications
• Implement runtime instrumentation with AddressSanitizer (ASan) to detect heap buffer overreads
• Review application logs for abnormal image processing failures

Monitoring Recommendations

• Enable crash reporting and analysis for systems using libsixel for image processing
• Configure process monitoring to alert on repeated img2sixel crashes
• Implement input validation logging to track crop parameters passed to libsixel functions
• Deploy memory debugging tools in development and staging environments

How to Mitigate CVE-2026-33019

Immediate Actions Required

• Upgrade libsixel to version 1.8.7-r1 or later immediately
• Audit systems for installed versions of libsixel below version 1.8.7-r1
• Restrict access to img2sixel on shared systems until patching is complete
• Review application integrations that pass user-controlled crop parameters to libsixel

Patch Information

The vulnerability has been fixed in libsixel version 1.8.7-r1. The patch implements overflow-safe bounds checking for the crop coordinate arithmetic operations, preventing integer overflow conditions from bypassing the bounds guard.

For detailed patch information, see the GitHub Release v1.8.7-r1 and the GitHub Security Advisory GHSA-c854-ffg9-g72c.

Workarounds

• Implement input validation to reject crop coordinates exceeding reasonable bounds before passing to libsixel
• Use compiler-level integer overflow protection flags (e.g., -ftrapv for GCC/Clang) during builds
• Run libsixel operations in sandboxed environments to contain potential information disclosure
• Disable or restrict access to the --crop functionality if not required for your use case