diff --git a/pkgs/by-name/li/libsixel/fix-CVE-2021-45340.patch b/pkgs/by-name/li/libsixel/fix-CVE-2021-45340.patch
new file mode 100644
index 0000000000000..84759e7d866a9
--- /dev/null
+++ b/pkgs/by-name/li/libsixel/fix-CVE-2021-45340.patch
@@ -0,0 +1,12 @@
+diff --git a/src/stb_image.h b/src/stb_image.h
+index f12c30b..526281c 100644
+--- a/src/stb_image.h
++++ b/src/stb_image.h
+@@ -1534,6 +1534,7 @@ static unsigned char *stbi__convert_format(unsigned char *data, int img_n, int r
+    int i,j;
+    unsigned char *good;
+
++   if (data == NULL) return data;
+    if (req_comp == img_n) return data;
+    STBI_ASSERT(req_comp >= 1 && req_comp <= 4);
+
diff --git a/pkgs/by-name/li/libsixel/package.nix b/pkgs/by-name/li/libsixel/package.nix
index 3add0a77716da..e8921c5d109a8 100644
--- a/pkgs/by-name/li/libsixel/package.nix
+++ b/pkgs/by-name/li/libsixel/package.nix
@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
     sha256 = "1nny4295ipy4ajcxmmh04c796hcds0y7z7rv3qd17mj70y8j0r2d";
   };
 
+  patches = [ ./fix-CVE-2021-45340.patch ];
+
   buildInputs = [
     gdk-pixbuf
     gd