CVE-2025-9300saitoha libsixel img2sixel encoder.c sixel_debug_print_palette stack-based overflow

4.8MediumCVSS base score
0.27%Exploitation in 30 daysEPSS · top 80% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
YesPublic exploitsa reference or SSVC says so

Description

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. 5 references of the record are tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.

Show the exploits5

References tagged exploit5 references

Timeline

2025
21 Aug 2025
21 Aug 2025
ID reserved
By VulDB
21 Aug 2025
21 Aug 2025
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-9300, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	4.0	Medium4.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
VulDBCNA (assigner)	3.1	Medium5.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
VulDBCNA (assigner)	3.0	Medium5.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
VulDBCNA (assigner)	2.0	Medium4.3	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
NVDNVD · Analyzed	4.0	Low1.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.27% · top 80% of all CVEs (14 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.

Affected products

saitoha · libsixel
- affected 1.10.0
- affected 1.10.1
- affected 1.10.2
- affected 1.10.3

References7

VDB-320905 | saitoha libsixel img2sixel encoder.c sixel_debug_print_palette stack-based overflow (opens in a new tab)vdb-entrytechnical-description
VDB-320905 | CTI Indicators (IOB, IOC, IOA) (opens in a new tab)signaturepermissions-required
Submit #632366 | LibSixel img2sixel LibSixel version 1.10.3 (commit 6dd664c) compiled on Aug 2 2025 and the newest master version. Heap Buffer Overflow (opens in a new tab)third-party-advisoryexploit
https://github.com/saitoha/libsixel/issues/200 (opens in a new tab)issue-trackingexploit
https://github.com/saitoha/libsixel/issues/200#issuecomment-3178785635 (opens in a new tab)issue-trackingexploit
https://drive.google.com/file/d/1IIvvRFgUQZcySqeoqXXhsxd0HZCjClJ7/view?usp=sharing (opens in a new tab)exploit
https://github.com/saitoha/libsixel/commit/316c086e79d66b62c0c4bc66229ee894e4fdb7d1 (opens in a new tab)patchexploit

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-9300](https://cveledger.app/badge/CVE-2025-9300.svg)](https://cveledger.app/cve/CVE-2025-9300)

Record last updated 21 Aug 2025, 14:46 UTC.