CVE-2022-27938: Libsixel

Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days.

stb_image.h (aka the stb image loader) 2.19, as used in libsixel and other products, has a reachable assertion in stbi__create_png_image_raw.

Affected products

• Libsixel Libsixel: before 1.10.4 (fixed in 1.10.4)
• Saitoha Libsixel: before 1.8.7 (fixed in 1.8.7)

Published 2022-03-26. Last modified 2026-06-17.