Executive brief
libsixel is a library used by applications to encode and decode images into the SIXEL format for display in terminals. A security flaw exists where the library incorrectly handles memory when processing images using the GDK-PixBuf2 component. If a user is tricked into opening a specially crafted image file with an affected application, an attacker could potentially crash the program, steal sensitive information from memory, or execute unauthorized code.
Technical details
A use-after-free (UAF) vulnerability exists in loader.c within the load_with_gdkpixbuf() function. The root cause is a manual memory deallocation strategy that bypasses the library's reference counting system; specifically, the code uses raw free() calls on sixel_frame_t objects instead of sixel_frame_unref(). This results in dangling pointers if a public callback has retained a reference to the frame. An attacker can exploit this by providing a crafted image file to an application linked against libsixel (built with --with-gdk-pixbuf2). Successful exploitation can lead to heap corruption, information disclosure, or arbitrary code execution. The issue is resolved in version 1.8.7-r1.
Affected products
- saitoha libsixel <= 1.8.7
Timeline
- 2026-04-14: disclosed
- 2026-04-14: patched: Fixed in version 1.8.7-r1
- 2026-04-14: advisory