CVE-2022-29977

There is an assertion failure error in stbi__jpeg_huff_decode, stb_image.h:1894 in libsixel...

6.5 MediumFix available

CVE-2022-29977 is a medium vulnerability (CVSS 6.5) in Saitoha Libsixel, published May 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.04%, the 63rd percentile. Fixed in libsixel 1:1.8.7-1.

There is an assertion failure error in stbi__jpeg_huff_decode, stb_image.h:1894 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.04%Unchanged since May 12, 2022

What each source reports

NVD Score used 6.5

Record: CVE-2022-29977
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-617
Updated: 2026-11-02

CVE List No score

Record: CVE-2022-29977
Updated: 2026-11-02

EUVDEUVD-2022-34283 No score

Record: EUVD-2022-34283
Updated: 2026-11-03

GitHub AdvisoriesGHSA-f8cq-g67g-w6xg 6.5

There is an assertion failure error in stbi__jpeg_huff_decode, stb_image.h:1894 in libsixel...

Record: GHSA-f8cq-g67g-w6xg
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-617
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-29977 6.5

Record: DEBIAN-CVE-2022-29977
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVUBUNTU-CVE-2022-29977 6.5

Record: UBUNTU-CVE-2022-29977
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV No score

Record: CVE-2022-29977
Updated: 2026-11-02

Affected products

saitoha libsixel

Affected packages

Affected packages
Package	Affected	Fixed
`libsixel` Debian:12	All versions, plus listed versions 1.10.3-31.10.5-11:1.8.7-11:1.8.7-21:1.8.7-3 Show 4 moreShow less 1:1.8.7-41:1.8.7-51:1.8.7-61:1.8.7-r2-1	None known
`libsixel` Debian:13	All versions, plus listed versions 1.10.5-11:1.8.7-11:1.8.7-21:1.8.7-31:1.8.7-41:1.8.7-51:1.8.7-61:1.8.7-r2-1	None known
`libsixel` Debian:14	before 1:1.8.7-1, plus listed versions 1.10.5-1	1:1.8.7-1
`libsixel` Ubuntu:16.04:LTS	All versions, plus listed versions 1.4.2-11.5.2-2	None known
`libsixel` Ubuntu:18.04:LTS	All versions, plus listed versions 1.5.2-21.7.3-1	None known
`libsixel` Ubuntu:20.04:LTS	All versions, plus listed versions 1.8.2-11.8.2-2.1	None known
`libsixel` Ubuntu:22.04:LTS	All versions, plus listed versions 1.8.6-21.10.3-21.10.3-3	None known
`libsixel` Ubuntu:24.04:LTS	All versions, plus listed versions 1.10.3-31.10.3-3build1	None known
`libsixel` Ubuntu:25.10	All versions, plus listed versions 1.10.5-1	None known
`libsixel` Ubuntu:26.10	All versions, plus listed versions 1.10.5-1build11:1.8.7-r2-1	None known
`libsixel` Ubuntu:26.04:LTS	All versions, plus listed versions 1.10.5-11.10.5-1build1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV