# CVE-2026-33023: saitoha libsixel use-after-free in load_with_gdkpixbuf

Source: https://junglewise.ai/threats/cve-2026-33023-saitoha-libsixel-use-after-free-in-load-with-gdkpixbuf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-33023 · Severity: high · CVSS 7.8 · Published 2026-04-14

libsixel is a library used by applications to encode and decode images into the SIXEL format for display in terminals. A security flaw exists where the library incorrectly handles memory when processing images using the GDK-PixBuf2 component. If a user is tricked into opening a specially crafted image file with an affected application, an attacker could potentially crash the program, steal sensitive information from memory, or execute unauthorized code.

Technologies: [Saitoha Libsixel](https://junglewise.ai/threats/technologies/libsixel). Vendors: [Saitoha](https://junglewise.ai/threats/vendors/saitoha).

## Quick answers

**Is CVE-2026-33023 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33023 being exploited in the wild.

**How severe is CVE-2026-33023?** High severity, with a CVSS score of 7.8, published 14 April 2026.

**Which products and versions are affected?** Saitoha Libsixel <= 1.8.7.

**Is there a fix for CVE-2026-33023?** A patch was published on 2026-04-14: Fixed in version 1.8.7-r1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33023 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-33023?** Check whether you run Saitoha Libsixel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in loader.c within the load_with_gdkpixbuf() function. The root cause is a manual memory deallocation strategy that bypasses the library's reference counting system; specifically, the code uses raw free() calls on sixel_frame_t objects instead of sixel_frame_unref(). This results in dangling pointers if a public callback has retained a reference to the frame. An attacker can exploit this by providing a crafted image file to an application linked against libsixel (built with --with-gdk-pixbuf2). Successful exploitation can lead to heap corruption, information disclosure, or arbitrary code execution. The issue is resolved in version 1.8.7-r1.

## Affected products

- saitoha libsixel <= 1.8.7

## Timeline

- 2026-04-14: disclosed
- 2026-04-14: patched: Fixed in version 1.8.7-r1
- 2026-04-14: advisory

## References

- [https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1](https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1)
- [https://github.com/saitoha/libsixel/security/advisories/GHSA-hr25-g2j6-qjw6](https://github.com/saitoha/libsixel/security/advisories/GHSA-hr25-g2j6-qjw6)

## Related threats

- [saitoha libsixel NULL pointer dereference in sixel_decode_raw](https://junglewise.ai/threats/cve-2026-44638-saitoha-libsixel-null-pointer-dereference-in-sixel-decode-raw)
- [saitoha libsixel integer overflow in SIXEL parser](https://junglewise.ai/threats/cve-2026-44637-saitoha-libsixel-integer-overflow-in-sixel-parser)
- [saitoha libsixel heap buffer overflow in sixel_encode_highcolor](https://junglewise.ai/threats/cve-2026-44636-saitoha-libsixel-heap-buffer-overflow-in-sixel-encode-highcolor)
- [saitoha libsixel use-after-free in sixel_encoder_encode_bytes](https://junglewise.ai/threats/cve-2026-33021-saitoha-libsixel-use-after-free-in-sixel-encoder-encode-bytes)
- [saitoha libsixel heap overflow in sixel_frame_convert_to_rgb888](https://junglewise.ai/threats/cve-2026-33020-saitoha-libsixel-heap-overflow-in-sixel-frame-convert-to-rgb888)