CVE-2026-33019: 
NixOS vulnerability analysis and mitigation

CVE-2026-33019 is an integer overflow vulnerability in libsixel (versions 1.8.7 and prior) that leads to an out-of-bounds heap read in the --crop option handling of the img2sixel utility. The flaw was discovered by researcher nicoppida and disclosed on April 14, 2026, with a fix released the same day in version 1.8.7-r1. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a signed integer overflow (CWE-190) in sixel_encoder_do_clip() within src/encoder.c, which leads to an out-of-bounds read (CWE-125). The crop coordinate parser only rejects negative values and zero-width/height inputs, allowing clip_x to be set to INT_MAX (2,147,483,647). The bounds guard expression clip_w + clip_x > src_width overflows to INT_MIN (-2,147,483,648) when clip_x = INT_MAX and clip_w = 1, causing the guard to evaluate as false and be skipped entirely. The unclamped clip_x value is then passed through sixel_frame_clip() to clip() in src/frame.c, where the pointer arithmetic src = frame->pixels + clip_y * src_w + clip_x computes an address far beyond the image buffer, and the resulting invalid pointer is passed to memmove(), triggering an out-of-bounds heap read and crash (GitHub Advisory).

Successful exploitation causes a reliable crash of the img2sixel application (denial of service) and enables potential disclosure of sensitive heap memory contents to the attacker. The confidentiality and availability impacts are both rated High, while integrity is unaffected. Exploitation requires local access and user interaction (e.g., a user running img2sixel with a malicious crop argument), limiting the blast radius, but heap memory disclosure could expose sensitive data processed by the application (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a concrete, reproducible command-line invocation: img2sixel -c "1x1+2147483647+0" -o /dev/null valid_gray_1x1.png. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.013% (0.000130), reflecting low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Prepare a valid image: Create or obtain any valid image file (e.g., a minimal 1×1 grayscale PNG named valid_gray_1x1.png) to serve as the input to img2sixel.
2. Craft the malicious crop argument: Construct a --crop argument using INT_MAX (2,147,483,647) as the x-coordinate offset, e.g., "1x1+2147483647+0" (width x height + x_offset + y_offset).
3. Execute the command: Run img2sixel -c "1x1+2147483647+0" -o /dev/null valid_gray_1x1.png on a system with a vulnerable version of libsixel (≤ 1.8.7).
4. Trigger the overflow: The crop parser accepts clip_x = 2,147,483,647 without rejection. In sixel_encoder_do_clip(), the expression clip_w + clip_x overflows to INT_MIN, bypassing the bounds guard.
5. Achieve out-of-bounds read: The unclamped coordinate is passed to clip(), which computes a source pointer 2,147,483,647 bytes beyond the image buffer and calls memmove() from that invalid address, causing a crash (SIGSEGV/ASAN SEGV) and potential heap memory disclosure (GitHub Advisory).

• Process: Unexpected crash or SIGSEGV of the img2sixel process; core dumps generated by img2sixel with unusually large crop coordinate values in the command line.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing img2sixel terminated with signal 11 (SIGSEGV) or similar memory fault; ASAN output containing SEGV on unknown address referencing clip() or memmove() in libsixel stack frames.
• File System: Presence of core dump files (e.g., core.*) in directories where img2sixel was executed; unexpected output files or absence of expected output when /dev/null is used as the output target.
• Command Line: Process execution logs (e.g., auditd) showing img2sixel invoked with -c arguments containing values near or equal to 2147483647 (GitHub Advisory).

Upgrade libsixel to version 1.8.7-r1 or later, which was released on April 14, 2026, and directly addresses this vulnerability along with several other security fixes. If immediate patching is not possible, restrict access to the img2sixel utility, avoid processing untrusted image files with the --crop option, and validate crop coordinate inputs to ensure clip_x and clip_y values do not approach INT_MAX. The patched release is available at the official libsixel GitHub repository (libsixel Release, GitHub Advisory).

Red Hat tracked the vulnerability via their security response process and opened a Bugzilla entry classifying it as medium severity for their products (Red Hat Bugzilla). The vulnerability was reported by researcher nicoppida, who also discovered several other security issues in libsixel fixed in the same release. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.