Upstream information

CVE-2026-110601 at MITRE

Description

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

CVSS v3 Scores
CVSS detail CNA (VulnCheck) SUSE
Base Score 6.3 7
Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local Local
Attack Complexity High High
Privileges Required None None
User Interaction Required Required
Scope Unchanged Unchanged
Confidentiality Impact None High
Integrity Impact High High
Availability Impact High High
CVSSv3 Version 3.1 3.1
CVSS v4 Scores
CVSS detail CNA (VulnCheck) SUSE
Base Score 5.8 7.3
Vector CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Attack Vector Local Local
Attack Complexity Low Low
Attack Requirements Present Present
Privileges Required None None
User Interaction Passive Passive
Vulnerable System Confidentiality Impact None High
Vulnerable System Integrity Impact High High
Vulnerable System Availability Impact High High
Subsequent System Confidentiality Impact None None
Subsequent System Integrity Impact None None
Subsequent System Availability Impact None None
CVSSv4 Version 4.0 4.0
SUSE Bugzilla entry: 1285653 [NEW]

No SUSE Security Announcements cross referenced.

SUSE Timeline for this CVE

CVE page created: Thu Oct 15 22:40:14 2026
CVE page last modified: Thu Oct 15 22:40:14 2026