Is CVE-2026-44638 actively exploited?

No active exploitation of CVE-2026-44638 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44638 be exploited remotely?

No. CVE-2026-44638 requires local access to exploit.

What is the CVSS score of CVE-2026-44638?

CVE-2026-44638 has a CVSS score of 2.5 (LOW).

HOME VULNERABILITIESCVE-2026-44638

LOW

CVE-2026-44638

CWE-476Published: May 14, 2026· Updated: May 15, 2026

2.5

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.9th

Official Description

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. From to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever the allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value the malloc returned. On allocation failure, the function continues and writes through a NULL pointer, crashing the process. This is a denial of service against any caller of these public APIs that hits a low-memory condition. This vulnerability is fixed in 1.8.7-r2.

NVD Source

Technical Analysis

CVE-2026-44638 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.