CVE-2025-9300: saitoha libsixel img2sixel encoder.c… (CVSS 4.8)

CVE List Score used 4.8

saitoha libsixel img2sixel encoder.c sixel_debug_print_palette stack-based overflow

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.

Record: CVE-2025-9300
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 2.0: 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
Weakness: CWE-121, CWE-119
Updated: 2026-11-02

EUVDEUVD-2025-25444 4.8

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.

Record: EUVD-2025-25444
CVSS 4.0: 4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-m23p-3g32-h722 1.9

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the...

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.

Record: GHSA-m23p-3g32-h722
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-119, CWE-787
Updated: 2026-11-02

NVD 1.9

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.

Record: CVE-2025-9300
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 4.3 MediumAV:L/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-119, CWE-121, CWE-787
Updated: 2026-11-02

OSV 1.9

saitoha libsixel img2sixel encoder.c sixel_debug_print_palette stack-based overflow

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.

Record: CVE-2025-9300
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weakness: CWE-119, CWE-121
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-9300 7.8

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.

Record: DEBIAN-CVE-2025-9300
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-9300 1.9

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.

Record: UBUNTU-CVE-2025-9300
CVSS 4.0: 1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15526-1 No score

libsixel-bash-completion-1.10.5-2.1 on GA media

These are all security issues fixed in the libsixel-bash-completion-1.10.5-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15526-1
Updated: 2026-11-02

Package	Affected	Fixed
`libsixel` Debian:12	All versions, plus listed versions 1.10.3-31.10.5-11:1.8.7-11:1.8.7-21:1.8.7-3 Show 4 moreShow less 1:1.8.7-41:1.8.7-51:1.8.7-61:1.8.7-r2-1	None known
`libsixel` Debian:13	All versions, plus listed versions 1.10.5-11:1.8.7-11:1.8.7-21:1.8.7-31:1.8.7-41:1.8.7-51:1.8.7-61:1.8.7-r2-1	None known
`libsixel` Debian:14	before 1:1.8.7-1, plus listed versions 1.10.5-1	1:1.8.7-1
`libsixel` Ubuntu:16.04:LTS	All versions, plus listed versions 1.4.2-11.5.2-2	None known
`libsixel` Ubuntu:18.04:LTS	All versions, plus listed versions 1.5.2-21.7.3-1	None known
`libsixel` Ubuntu:20.04:LTS	All versions, plus listed versions 1.8.2-11.8.2-2.1	None known
`libsixel` Ubuntu:22.04:LTS	All versions, plus listed versions 1.8.6-21.10.3-21.10.3-3	None known
`libsixel` Ubuntu:24.04:LTS	All versions, plus listed versions 1.10.3-31.10.3-3build1	None known
`libsixel` Ubuntu:25.10	All versions, plus listed versions 1.10.5-1	None known
`libsixel` Ubuntu:26.10	All versions, plus listed versions 1.10.5-1build11:1.8.7-r2-1	None known
`libsixel` Ubuntu:26.04:LTS	All versions, plus listed versions 1.10.5-11.10.5-1build1	None known
`libsixel` openSUSE:Tumbleweed	before 1.10.5-2.1	1.10.5-2.1

CVE-2025-9300

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

References