Bug 2552256 (CVE-2026-110601)

Summary: CVE-2026-110601 libsixel: libsixel: Memory corruption via crafted GIF image
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libsixel. This vulnerability allows an attacker to cause memory corruption and application crashes, resulting in a Denial of Service (DoS), by tricking an application into processing a specially crafted GIF image. The issue occurs because the image parser fails to validate the transparent color index against the allocated color palette size, causing out-of-bounds data to be written to heap memory.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2553653    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-14 14:33:04 UTC 
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.