CVE-2025-9300: 
NixOS vulnerability analysis and mitigation

CVE-2025-9300 is a heap-based buffer overflow vulnerability in the sixel_debug_print_palette function of the img2sixel component in the libsixel library. It affects libsixel versions up to and including 1.10.3 (all versions prior to the patch commit). The vulnerability was discovered through fuzzing and reported on August 12, 2025, with public disclosure on August 21, 2025. It carries a CVSS v3.1 base score of 7.8 (High), requiring only local access and low privileges to exploit (Red Hat Advisory, Red Hat Bugzilla).

The root cause is insufficient bounds checking in the sixel_debug_print_palette function in src/encoder.c (CWE-119, CWE-121, CWE-787). During image-to-sixel conversion, a 136-byte palette buffer is allocated via sixel_dither_new() in dither.c:306; however, the debug print loop at line 735 reads one byte beyond the allocated region boundary due to an off-by-one indexing error — specifically, the format string incorrectly referenced palette[i * 3 + 3] instead of palette[i * 3 + 2]. The vulnerability is triggered by processing a specially crafted malformed image file with the --verbose flag enabled, following the call chain: main() → sixel_encoder_encode() → sixel_encoder_encode_frame() → sixel_debug_print_palette(). A proof-of-concept file and reproduction steps have been publicly disclosed (GitHub Issue #200, Patch Commit).

Successful exploitation can result in high confidentiality, integrity, and availability impact on the affected system, as reflected in the CVSS v3.1 score. An attacker with local access who can supply a crafted image file to img2sixel (particularly with verbose/debug output enabled) may trigger memory corruption that could lead to application crashes (denial of service) or potentially arbitrary code execution. The scope is limited to the local system and the process running the vulnerable libsixel component, with no direct lateral movement capability, but privilege escalation on the affected host is a theoretical risk (Red Hat Advisory, GitHub Issue #200).

A proof-of-concept exploit file (POC_img2sixel_heap_buffer_overflow) has been publicly released and is available for download, along with detailed reproduction steps (GitHub Issue #200). The EPSS score is approximately 0.013% (0.000130), indicating a low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires local access and low privileges, limiting its remote exploitability (VulDB).

1. Obtain a vulnerable system: Identify a system running libsixel version 1.10.3 or earlier with the img2sixel converter available and accessible to a local user.
2. Prepare the malformed image file: Obtain or craft a specially structured image file that triggers the palette buffer overflow condition — a public PoC file (POC_img2sixel_heap_buffer_overflow) is available via the GitHub issue report.
3. Invoke img2sixel with verbose/debug mode: Execute the converter with flags that enable debug palette output: img2sixel --7bit-mode -8 --invert --palette-type=auto --verbose POC_img2sixel_heap_buffer_overflow -o /dev/null
4. Trigger the overflow: The sixel_debug_print_palette function reads one byte past the end of the 136-byte palette buffer, causing a heap buffer overflow (detected as SIGABRT with AddressSanitizer, or potentially exploitable memory corruption in production builds).
5. Achieve impact: Depending on heap layout and memory protections, the overflow may result in a crash (denial of service) or, in a worst-case scenario, controlled memory corruption enabling code execution under the privileges of the running process (GitHub Issue #200, Patch Commit).

• Process: Unexpected crashes or SIGABRT signals from the img2sixel process, particularly when processing image files with the --verbose flag enabled.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing img2sixel terminating abnormally with signal 6 (SIGABRT) or segmentation faults.
• File System: Presence of unknown or suspicious image files (e.g., small, malformed files with unusual structure) in directories accessible to img2sixel; presence of AddressSanitizer crash reports referencing sixel_debug_print_palette in encoder.c:735.
• Network: No network-based IOCs are expected given the local-only attack vector.

Apply the upstream patch identified by commit 316c086e79d66b62c0c4bc66229ee894e4fdb7d1, which corrects the off-by-one indexing error in sixel_debug_print_palette in src/encoder.c. Fedora 41 and 42 have issued updated libsixel packages addressing this vulnerability. As a workaround, avoid running img2sixel with the --verbose flag on untrusted input files, and restrict local user access to systems running vulnerable libsixel versions. Upgrading to a patched version of libsixel is the recommended long-term remediation (Patch Commit, Red Hat Bugzilla).

Red Hat tracked the vulnerability via their security response process and assigned it medium severity in their Bugzilla system. The vulnerability was discovered by security researcher err2zero through fuzzing and responsibly reported via the libsixel GitHub issue tracker, where the maintainer promptly issued a patch. Fedora issued security advisories for both Fedora 41 and Fedora 42 to update the libsixel package. Coverage has been limited to vulnerability aggregators and Linux security news outlets, with no significant broader media attention (Red Hat Bugzilla, GitHub Issue #200).