CVE-2022-29978

What it actually does

A floating point exception occurs in sixel_encoder_do_resize (encoder.c:633) when libsixel processes a malformed JPEG, causing the img2sixel process to terminate abnormally.

Why it matters to the business

Image conversion or viewing services that rely on libsixel become unavailable when they encounter a malicious image file, interrupting workflows that depend on sixel output generation.

How an attack unfolds

An attacker creates a specially crafted JPEG that triggers an unhandled floating-point error inside the resize routine; when a victim application invokes img2sixel or an equivalent sixel encoder on the file, the process crashes and service is denied.

How to fix it

Upgrade to a patched version of libsixel once released; until then, isolate or disable img2sixel processing of untrusted JPEG files and apply input sanitization or sandboxing around the converter.

How to confirm the fix worked

Confirm the installed libsixel version is newer than 1.8.6; test conversion of the original proof-of-concept JPEG and verify the process no longer terminates with a floating-point exception.

Typical attack path

1. Craft a JPEG file that causes division-by-zero or invalid floating-point operation in sixel_encoder_do_resize
2. Deliver the file to a target system or service that uses libsixel 1.8.6 for image-to-sixel conversion
3. Trigger conversion via command-line tool, library API call, or automated pipeline
4. Observe process termination and denial of service

How to detect it

Review application and system logs for abrupt termination of img2sixel or processes linking against libsixel, especially entries containing floating-point exception, SIGFPE, or stack traces referencing sixel_encoder_do_resize.

• sixel_encoder_do_resize
• encoder.c:633
• Floating point exception
• img2sixel

What your security team should do

• Inventory all systems and containers using libsixel or the img2sixel binary
• Block or filter untrusted JPEG inputs to sixel conversion paths until an update is available
• Monitor process crash logs for floating-point exceptions originating from encoder.c
• Plan upgrade to the next stable libsixel release as soon as it is published