Use-After-Free Vulnerability in libsixel by saitoha

CVE-2026-33021

What is CVE-2026-33021?

In versions 1.8.7 and prior, libsixel includes a use-after-free vulnerability in the sixel_encoder_encode_bytes() function. The issue arises when the sixel_frame_init() function directly stores a pointer to a caller-owned pixel buffer in frame->pixels without creating a defensive copy. When a resize operation occurs, the sixel_frame_convert_to_rgb888() function improperly frees the caller's buffer and replaces it with an internal allocation, resulting in a dangling pointer. This can lead to repeated and predictable crashes, with a potential for code execution if an attacker controls incoming frames. The vulnerability has been addressed in version 1.8.7-r1.

References