Quick answers
- Is CVE-2026-33023 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-33023 being exploited in the wild.
- How severe is CVE-2026-33023?
- High severity, with a CVSS score of 7.8, published 14 April 2026.
- Which products and versions are affected?
- Saitoha Libsixel <= 1.8.7.
- Is there a fix for CVE-2026-33023?
- A patch was published on 2026-04-14: Fixed in version 1.8.7-r1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-33023 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-33023?
- Check whether you run Saitoha Libsixel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free (UAF) vulnerability exists in loader.c within the load_with_gdkpixbuf() function. The root cause is a manual memory deallocation strategy that bypasses the library's reference counting system; specifically, the code uses raw free() calls on sixel_frame_t objects instead of sixel_frame_unref(). This results in dangling pointers if a public callback has retained a reference to the frame. An attacker can exploit this by providing a crafted image file to an application linked against libsixel (built with --with-gdk-pixbuf2). Successful exploitation can lead to heap corruption, information disclosure, or arbitrary code execution. The issue is resolved in version 1.8.7-r1.
Affected products
- saitoha libsixel <= 1.8.7
Timeline
- 2026-04-14: disclosed
- 2026-04-14: patched: Fixed in version 1.8.7-r1
- 2026-04-14: advisory