Junglewise Threat Intelligence

CVE-2026-11623: tmux use-after-free in Sixel image LRU eviction

CVE-2026-11623 · Severity: medium · CVSS 4.5 · Published 2026-06-09

Executive brief

A security vulnerability exists in tmux, a popular tool used to manage multiple terminal sessions. An attacker can trigger a memory error by sending specific image data to a terminal window, which can cause the tmux server to crash and close all active user sessions. In some cases, this could potentially allow an attacker to gain unauthorized control over the system where tmux is running.

Technical details

A use-after-free (UAF) vulnerability exists in tmux versions up to 3.6a within the image_free function in image.c. The root cause is a logic error during Sixel image Least Recently Used (LRU) eviction: when a user switches to an alternate screen, images are moved from the active images list to a saved images list, but the global LRU list is not updated. When the global limit is reached, image_free attempts to remove the image from the active list using TAILQ_REMOVE, even if it currently resides in the saved list. This results in doubly-linked list metadata corruption and a UAF condition. An attacker can exploit this by outputting a malicious Sixel sequence to a pane, potentially achieving arbitrary code execution or a denial of service (server crash). A fix is available in version 3.7-rc and via patch fc6d94a9f8a593bd8b7031650802084385d4ee03.

Affected products

  • tmux tmux <= 3.6a

Timeline

  • 2026-05-22: disclosed: Vulnerability details shared via GitHub Gist by XlabAITeam
  • 2026-06-08: patched: tmux 3.7-rc released containing the fix
  • 2026-06-09: advisory: CVE-2026-11623 published

References