libsixel, a SIXEL encoder/decoder, has a use‑after‑free flaw in sixel_encoder_encode_bytes() for versions 1.8.7 and earlier. The flaw occurs because sixel_frame_init() stores a caller‑owned pixel buffer directly without copying, and a subsequent resize triggers sixel_frame_convert_to_rgb888() to free that external buffer, leaving a dangling pointer. If the caller then accesses the original buffer, a crash occurs. The vendor’s AddressSanitizer testing indicates that repeated, predictable triggering could also enable code execution, although this is not a confirmed remote code execution vulnerability.

The saitoha:libsixel packages up to and including 1.8.7 are affected. The release 1.8.7‑r1 resolves the issue by making a defensive copy of pixel data, eliminating the dangling pointer.

With a CVSS score of 7.3, the vulnerability is considered high severity. The EPSS score is under 1%, suggesting a low probability of opportunistic exploitation, and it is not listed in CISA’s KEV catalog. An attacker who can supply crafted SIXEL frames can reliably trigger the flaw, causing crashes or possibly execution, especially in untrusted input scenarios. Overall, the risk warrants prompt remediation.