This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-110601 →

DEBIAN-CVE-2026-110601

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never...

Original description

The description as published by the source.

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libsixel

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 libsixel

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 libsixel

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.7-r2-1"}]}]

References

advisory security-tracker.debian.org