A tmux session may suffer a use‑after‑free condition when the image_free routine in image.c releases memory that has already been freed earlier. Because the flaw is triggered only with local access and requires the attacker to supply crafted image data, the attack is not trivial; the disclosed exploit is described as high complexity and difficult to execute. Nevertheless, the vulnerability can corrupt the process memory of a running tmux instance, potentially leading to arbitrary code execution or denial of service.

The vulnerability affects the tmux terminal multiplexer up to version 3.6a. Even the release candidate 3.7‑rc includes the patch that removes the dangling pointer condition. Therefore, systems running tmux 3.6, 3.6a, or earlier are impacted; versions 3.7‑rc and later are considered mitigated.

The CVSS score of 2.0 marks this flaw as low severity. EPSS data is unavailable, and the issue is not listed in CISA's KEV catalog. The flaw requires local access to the target machine and knowledge of image handling; the complexity is high and exploitation is difficult, which lowers the practical threat. Nevertheless, because the bug can lead to memory corruption, any local attacker who can interact with a tmux session has a realistic path to compromise that process.