What’s Vulnerable › Vulnerabilities

CVE-2020-21048

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-14 · updated 2026-06-17

Description

An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.

Affected products

• saitoha libsixel: before 1.8.4 — fixed in 1.8.4

How to fix

Upgrade to a fixed version: saitoha libsixel 1.8.4. Check the vendor advisory for mitigations.

References

• https://bitbucket.org/netbsd/pkgsrc/commits/6f0c011cbfccdffa635d04c84433b1a02687adad
• https://github.com/saitoha/libsixel/blob/master/ChangeLog
• https://github.com/saitoha/libsixel/commit/cb373ab6614c910407c5e5a93ab935144e62b037
• https://github.com/saitoha/libsixel/issues/73
• https://github.com/saitoha/libsixel/releases/tag/v1.8.4
• https://bitbucket.org/netbsd/pkgsrc/commits/6f0c011cbfccdffa635d04c84433b1a02687adad
• https://github.com/saitoha/libsixel/blob/master/ChangeLog
• https://github.com/saitoha/libsixel/commit/cb373ab6614c910407c5e5a93ab935144e62b037
• https://github.com/saitoha/libsixel/issues/73
• https://github.com/saitoha/libsixel/releases/tag/v1.8.4

Get alerted when CVE-2020-21048 or the next vulnerability affects your stack