CVE-2025-61146: 
NixOS vulnerability analysis and mitigation

CVE-2025-61146 is a memory leak vulnerability in saitoha libsixel affecting all versions prior to v1.8.7, located in the malloc_stub.c component. The flaw was reported by researcher @optionGo on September 2, 2025, via a GitHub issue, and publicly disclosed in February 2026. It carries a CVSS v3.1 base score of 4.0 (Medium), with a local attack vector and low availability impact (Feedly, GitHub Issue).

The vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). Specifically, in src/fromgif.c, when processing GIF frames, previously allocated pixel buffers (frame->pixels) were not freed before being reassigned during re-initialization of a frame — causing a memory leak in the rpl_malloc function within malloc_stub.c at line 45. The fix, committed by the maintainer, adds an explicit sixel_allocator_free() call before reallocating the pixel buffer (GitHub Commit, GitHub Issue). A proof-of-concept GIF file was contributed by the reporter and is included in the repository's test suite (GitHub Commit).

Successful exploitation results in gradual memory consumption over time as the application processes GIF images without releasing intermediate pixel buffers. This can lead to denial of service through resource exhaustion, causing the application or system to become unresponsive or crash. There is no impact on confidentiality or integrity; the vulnerability is limited to availability of systems or applications that embed the libsixel library (Feedly).

There is no evidence of in-the-wild exploitation or public weaponized exploit code for CVE-2025-61146. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability requires local access and is triggered by processing a specially crafted GIF file with the img2sixel converter or any application using the libsixel library. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, GitHub Issue).

1. Prepare a malicious GIF: Obtain or craft a GIF file that triggers repeated frame re-initialization in libsixel's GIF decoder, causing the pixel buffer to be reallocated without freeing the previous allocation. A PoC file was contributed by @optionGo and is available in the libsixel test suite (tests/issue/207/poc).
2. Invoke the vulnerable application: Run the img2sixel converter (or any application embedding libsixel < 1.8.7) against the crafted GIF, e.g.: converters/img2sixel -h 50% -r lanczos3 -w 300px tests/issue/207/poc
3. Trigger memory leak: Each frame processed causes frame->pixels to be reallocated without freeing the prior buffer, incrementally leaking memory.
4. Achieve denial of service: Repeated or sustained processing of such GIF files exhausts available memory, potentially crashing the application or degrading system performance (GitHub Commit, GitHub Issue).

• Process Behavior: Abnormal and steadily increasing memory consumption by processes using libsixel (e.g., img2sixel) when processing GIF files, detectable via top, htop, or system memory monitoring tools.
• Logs: Address Sanitizer (ASan) reports referencing malloc_stub.c:45:20 or fromgif.c in application logs when running with sanitizer instrumentation enabled.
• File System: Presence of unexpected or externally supplied GIF files being fed to libsixel-based applications, particularly files with multiple frames triggering repeated pixel buffer allocation.

Upgrade libsixel to version 1.8.7 or later, which includes the fix that adds an explicit sixel_allocator_free() call before pixel buffer reallocation in src/fromgif.c. The patch is available in the official GitHub repository (GitHub Commit). As a temporary workaround, restrict processing of untrusted GIF files through libsixel-based applications, and implement OS-level memory limits (e.g., ulimit -v) to contain the impact of resource exhaustion. Fedora packages have been updated to address this issue (Linux Security).

The vulnerability received routine coverage from Linux security advisory aggregators, with Fedora issuing an updated package for libsixel addressing CVE-2025-61146. German Linux news outlet pro-linux.de published advisories noting the denial-of-service risk. Tenable released multiple Nessus detection plugins (IDs 299834, 301188, 301185, 301426) for the vulnerability. No significant social media discussion or high-profile researcher commentary has been observed beyond the original GitHub issue report (Linux Security, Tenable).