CVE-2020-21049

An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to...

6.5 MediumFix available

CVE-2020-21049 is a medium vulnerability (CVSS 6.5) in Saitoha Libsixel, published September 14, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in libsixel 1.8.6-1.

An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.38%Down 0.2 points since Sep 15, 2021

What each source reports

NVD Score used 6.5

An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.

Record: CVE-2020-21049
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.

Record: CVE-2020-21049
Updated: 2026-11-02

EUVDEUVD-2020-13828 No score

An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.

Record: EUVD-2020-13828
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v6gq-6h27-8r9r 6.5

An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to...

An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.

Record: GHSA-v6gq-6h27-8r9r
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSV 6.5

An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.

Record: CVE-2020-21049
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-21049 6.5

An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.

Record: DEBIAN-CVE-2020-21049
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-21049 6.5

An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.

Record: UBUNTU-CVE-2020-21049
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

saitoha libsixel

Affected packages

Affected packages
Package	Affected	Fixed
`libsixel` Debian:12	before 1.8.6-1	1.8.6-1
`libsixel` Debian:13	before 1.8.6-1	1.8.6-1
`libsixel` Debian:14	before 1.8.6-1	1.8.6-1
`libsixel` Ubuntu:16.04:LTS	All versions, plus listed versions 1.4.2-11.5.2-2	None known
`libsixel` Ubuntu:18.04:LTS	All versions, plus listed versions 1.5.2-21.7.3-1	None known
`libsixel` Ubuntu:20.04:LTS	All versions, plus listed versions 1.8.2-11.8.2-2.1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 4 moreShow less