A Use-After-Free condition arises in the load_gif() function of libsixel when handling animated GIFs. The function reuses a single sixel_frame_t object for each frame and frees its pixel buffer unconditionally, without checking the reference count. When a user-supplied callback follows the documented reference pattern, it may access a dangling pointer after decoding the second frame, which has been confirmed by AddressSanitizer. This leads to a reliable crash and, if an attacker controls memory layout, can be leveraged for arbitrary code execution.

The library affected is saitoha:libsixel, version 1.8.7 and all earlier releases. The fix was released in version 1.8.7-r1; any application linking against an unpatched library and calling sixel_helper_load_image_file() with a multi‑frame callback on user‑supplied animated GIFs is impacted.

The CVSS score of 7 indicates a high severity, but the EPSS score is unavailable, so current exploitation likelihood is unknown. The vulnerability is not present in CISA’s KEV catalog, implying no confirmed widespread exploitation yet. Attackers would need to supply a malicious animated GIF to a vulnerable application; the use‑after‑free provides a crash baseline, and if the attacker can influence heap contents, code execution is possible. Successful exploitation typically requires the victim process to have sufficient privileges to compromise the host. The documented usage pattern it straightforward for an attacker to trigger the flaw if they can manipulate the callback.