CVE-2026-33021

libsixel: Use-after-free in sixel_encoder_encode_bytes()

Published Apr 14, 2026 CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Description

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame->pixels without making a defensive copy. When a resize operation is triggered, sixel_frame_convert_to_rgb888() unconditionally frees this caller-owned buffer and replaces it with a new internal allocation, leaving the caller with a dangling pointer. Any subsequent access to the original buffer by the caller constitutes a use-after-free, confirmed by AddressSanitizer. An attacker who controls incoming frames can trigger this bug repeatedly and predictably, resulting in a reliable crash with potential for code execution. This issue has been fixed in version 1.8.7-r1.

Analysis

Technical impact

libsixel, a SIXEL encoder/decoder, has a use‑after‑free flaw in sixel_encoder_encode_bytes() for versions 1.8.7 and earlier. The flaw occurs because sixel_frame_init() stores a caller‑owned pixel buffer directly without copying, and a subsequent resize triggers sixel_frame_convert_to_rgb888() to free that external buffer, leaving a dangling pointer. If the caller then accesses the original buffer, a crash occurs. The vendor’s AddressSanitizer testing indicates that repeated, predictable triggering could also enable code execution, although this is not a confirmed remote code execution vulnerability.

Affected Systems

The saitoha:libsixel packages up to and including 1.8.7 are affected. The release 1.8.7‑r1 resolves the issue by making a defensive copy of pixel data, eliminating the dangling pointer.

Risk and Exploitability

With a CVSS score of 7.3, the vulnerability is considered high severity. The EPSS score is under 1%, suggesting a low probability of opportunistic exploitation, and it is not listed in CISA’s KEV catalog. An attacker who can supply crafted SIXEL frames can reliably trigger the flaw, causing crashes or possibly execution, especially in untrusted input scenarios. Overall, the risk warrants prompt remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

saitoha

libsixel

affected

Version	Status	Constraints
`< 1.8.7-r1`	affected	—

Configuration 1 [-]

cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Saitoha

Libsixel

Version	Status	Scheme	Platform
`[0,1.8.7-r1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the libsixel package to version 1.8.7‑r1 or later, which copies pixel buffers internally and addresses CWE‑416 and CWE‑825.
Ensure that any caller‑owned buffers passed to sixel_encoder_encode_bytes() are not freed by the library by audit or by avoiding passing external buffers if they might be freed during conversion.
Validate all incoming SIXEL frames before encoding; reject frames with unexpected size or content, and use safe parsing to mitigate the use‑after‑free condition.

Generated by OpenCVE AI on April 15, 2026 at 14:21 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.252% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1
https://github.com/saitoha/libsixel/security/advisories/GHSA-j6m5-2cc7-3whc
https://nvd.nist.gov/vuln/detail/CVE-2026-33021
https://www.cve.org/CVERecord?id=CVE-2026-33021

History

Apr 23, 2026 2:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:saitoha:libsixel::::::::

Apr 16, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 15, 2026 2:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Saitoha Saitoha libsixel
Vendors & Products		Saitoha Saitoha libsixel

Apr 15, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-33021 https://www.cve.org/CVERecord?id=CVE-2026-33021
Metrics	threat_severity `None`	threat_severity `Moderate`

Apr 14, 2026 10:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame->pixels without making a defensive copy. When a resize operation is triggered, sixel_frame_convert_to_rgb888() unconditionally frees this caller-owned buffer and replaces it with a new internal allocation, leaving the caller with a dangling pointer. Any subsequent access to the original buffer by the caller constitutes a use-after-free, confirmed by AddressSanitizer. An attacker who controls incoming frames can trigger this bug repeatedly and predictably, resulting in a reliable crash with potential for code execution. This issue has been fixed in version 1.8.7-r1.
Title		libsixel: Use-after-free in sixel_encoder_encode_bytes()
Weaknesses		CWE-416
References		https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1 https://github.com/saitoha/libsixel/security/advisories/GHSA-j6m5-2cc7-3whc
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'}`