Use-After-Free Vulnerability in libsixel Affects Animated GIF Handling

CVE-2026-33018

What is CVE-2026-33018?

libsixel, a SIXEL encoder/decoder implementation, has a significant vulnerability in its handling of animated GIF images. The flaw stems from the load_gif() function, where resources are improperly managed, leading to a possible use-after-free scenario. Specifically, the sixel_frame_t object is reused across frames in an animated GIF without adequately handling the reference count during frame processing. This can trigger crashes or potentially allow an attacker to execute arbitrary code if their input is processed. Applications using the sixel_helper_load_image_file() function with multi-frame callbacks for animated GIFs are particularly susceptible. This issue has been addressed in version 1.8.7-r1.

References