PT-2026-32952 · Libsixel · Libsixel

Nicoppida · Published 2026-04-14 · Updated 2026-04-23 · CVE-2026-33023

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libsixel versions prior to 1.8.7-r1

Description A use-after-free issue exists in the load with gdkpixbuf() function within loader.c when the software is built with the --with-gdk-pixbuf2 option. The problem occurs because the cleanup path manually frees the sixel frame t object and its internal buffers without checking the reference count, despite the object being created via the refcounted constructor sixel frame new(). Consequently, any callback that uses sixel frame ref(frame) to maintain a reference will be left with a dangling pointer after sixel helper load image file() returns. An attacker can trigger this by providing a crafted image to an application built with gdk-pixbuf2 support, which may lead to memory corruption, information disclosure, or code execution.

Recommendations Update to version 1.8.7-r1.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-33023

Affected Products

Libsixel

References · 12

• 🔥 https://github.com/saitoha/libsixel/security/advisories/GHSA-hr25-g2j6-qjw6 · Exploit
• https://cve.org/CVERecord?id=CVE-2026-33023 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33023 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33023 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33023 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33023 · Vendor Advisory
• https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1 · Note
• https://twitter.com/VulmonFeeds/status/2044256903446872166 · Twitter Post
• https://twitter.com/integ_sec/status/2044773327986639219 · Twitter Post
• https://twitter.com/giuseppe_1337/status/2047144759001579677 · Twitter Post
• https://twitter.com/CVEnew/status/2044338899250802712 · Twitter Post