CVE-2026-33023
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
In libsixel versions 1.8.7 and prior, built with --with-gdk-pixbuf2, a use-after-free vulnerability exists in load_with_gdkpixbuf(). The cleanup path manually frees the sixel_frame_t object without consulting the reference count, leading to a dangling pointer. An attacker can supply a crafted image, potentially causing information disclosure, memory corruption, or code execution.
Risk Assessment
Organizations using applications based on libsixel with gdk-pixbuf2 support are at risk of remote code execution or data leakage via a crafted image.
Recommendation
Update libsixel to version 1.8.7-r1 or later, which contains the fix.
Other vulnerabilities in libsixel
See all- CVE-2026-110601Medium
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes.
- CVE-2026-44638Low
In libsixel (a SIXEL encoder/decoder implementation) up to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value returned by malloc, so on allocation failure the function continues and writes through a NULL pointer, crashing the process. The vulnerability is fixed in 1.8.7-r2.
- CVE-2026-44637High
The libsixel library has a signed integer overflow in the image-buffer doubling loop of the SIXEL parser, which can lead to an out-of-bounds heap write. This issue affects versions up to 1.8.7-r1 and is fixed in version 1.8.7-r2.
- CVE-2026-44636High
The libsixel library has a heap buffer overflow due to incorrect allocation size calculation in the sixel_encode_highcolor function. This issue affects versions from 1.8.7-r1 to 1.8.7-r2, where the lack of an upper bound for width and height allows for potential memory overwrites.
Original NVD description (English source)
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. In versions 1.8.7 and prior, when built with the --with-gdk-pixbuf2 option, a use-after-free vulnerability exists in load_with_gdkpixbuf() in loader.c. The cleanup path manually frees the sixel_frame_t object and its internal buffers without consulting the reference count, even though the object was created via the refcounted constructor sixel_frame_new() and exposed to the public callback. A callback that calls sixel_frame_ref(frame) to retain a logically valid reference will hold a dangling pointer after sixel_helper_load_image_file() returns, and any subsequent access to the frame or its fields triggers a use-after-free confirmed by AddressSanitizer. The root cause is a consistency failure between two cleanup strategies in the same codebase: sixel_frame_unref() is used in load_with_builtin() but raw free() is used in load_with_gdkpixbuf(). An attacker supplying a crafted image to any application built against libsixel with gdk-pixbuf2 support can trigger this reliably, potentially leading to information disclosure, memory corruption, or code execution. This issue has been fixed in version 1.8.7-r1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS