CVE-2025-9300

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121 CWE-787

Affected software

Vendor	Product	Versions
saitoha	libsixel	1.10.0; 1.10.1; 1.10.2; 1.10.3

References

https://drive.google.com/file/d/1IIvvRFgUQZcySqeoqXXhsxd0HZCjClJ7/view?usp=sharingExploit
https://github.com/saitoha/libsixel/commit/316c086e79d66b62c0c4bc66229ee894e4fdb7d1Patch
https://github.com/saitoha/libsixel/issues/200Exploit, Issue Tracking
https://github.com/saitoha/libsixel/issues/200#issuecomment-3178785635Exploit, Issue Tracking
https://vuldb.com/?ctiid.320905Permissions Required, VDB Entry
https://vuldb.com/?id.320905Third Party Advisory, VDB Entry
https://vuldb.com/?submit.632366Exploit, Third Party Advisory, VDB Entry
https://github.com/saitoha/libsixel/commit/316c086e79d66b62c0c4bc66229ee894e4fdb7d1Patch
https://github.com/saitoha/libsixel/issues/200Exploit, Issue Tracking
https://github.com/saitoha/libsixel/issues/200#issuecomment-3178785635Exploit, Issue Tracking
https://vuldb.com/?submit.632366Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Aug 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-93013.3A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file c CVE-2025-93029.8A vulnerability was identified in PHPGurukul User Management System 1.0. This vulnerability affects unknown code of the file /signup.php. Su CVE-2025-93039.8A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParentalRules of the file /c CVE-2025-93049.8A weakness has been identified in SourceCodester Online Bank Management System 1.0. Impacted is an unknown function of the file /bank/show.p CVE-2025-93059.8A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. The affected element is an unknown function CVE-2025-93065.4A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the fil CVE-2025-93079.8A flaw has been found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /admin/session.php. This ma CVE-2025-93085.5A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. CVE-2025-93097.0A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Ha CVE-2025-93107.5A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unkn CVE-2025-93119.8A vulnerability was identified in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the CVE-2025-93129.8A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services