What is CVE-2026-44638?

CVE-2026-44638 is a low-severity vulnerability in Saitoha Libsixel, classified under NULL Pointer Dereference. CVSS score: 2.5/10. Published 2026-05-14.

How severe is CVE-2026-44638?

Low severity. CVSS v3 base score is 2.5 out of 10.

NULL pointer dereference in Saitoha Libsixel

CVE-2026-44638

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.

Published 2026-05-14 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 2.5 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.001 (2.0th percentile), scored 2026-10-19.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 2nd percentile — 2.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: -0.000

Affected products

Saitoha Libsixel — versions >= 1.0.0, < 1.8.7-r2

Weakness classification (CWE)

References

github.com/saitoha/libsixel/security/advisories/GHSA-wpx3-h5g8-qr3w (Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2026-44638?: CVE-2026-44638 is a low-severity vulnerability in Saitoha Libsixel, classified under NULL Pointer Dereference. CVSS score: 2.5/10. Published 2026-05-14.
How severe is CVE-2026-44638?: Low severity. CVSS v3 base score is 2.5 out of 10.