CVE-2026-33021 libsixel: Use-after-free in sixel_encoder_encode_bytes()
An attacker can trigger a use-after-free in libsixel by controlling input frames, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33021?
CVE-2026-33021 is a high-severity use after free vulnerability in saitoha libsixel, published on 14 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame->pixels without making a defensive copy. When a resize operation is triggered, sixel_frame_convert_to_rgb888() unconditionally frees this caller-owned buffer and replaces it with a new internal allocation, leaving the caller with a dangling pointer. Any subsequent access to the original buffer by the caller constitutes a use-after-free, confirmed by AddressSanitizer. An attacker who controls incoming frames can trigger this bug repeatedly and predictably, resulting in a reliable crash with potential for code execution. This issue has been fixed in version 1.8.7-r1.
Weakness: CWE-416
Which versions are affected by CVE-2026-33021?
It affects 1 product.
Products include Saitoha Libsixel.
How do I fix CVE-2026-33021?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-33021 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33021 exists.
Other vulnerabilities in saitoha libsixel
Sources
Also known as DEBIAN-CVE-2026-33021, GHSA-j6m5-2cc7-3whc, UBUNTU-CVE-2026-33021.