libsixel Use-After-Free: Critical Flaw in GIF Processing

The National Vulnerability Database has disclosed CVE-2026-33018, a high-severity Use-After-Free vulnerability in libsixel, a widely used SIXEL encoder/decoder implementation. Affecting versions 1.8.7 and prior, this critical flaw resides within the load_gif() function in fromgif.c, specifically in how it handles animated GIFs.

According to the National Vulnerability Database, the issue arises because a single sixel_frame_t object is reused across all frames of an animated GIF. The gif_init_frame() function then unconditionally frees and reallocates frame->pixels between frames, without adequately checking the object’s reference count. This means any application using sixel_helper_load_image_file() with a multi-frame callback to process user-supplied animated GIFs will leave a dangling pointer after the second frame is decoded if it follows the documented sixel_frame_ref() and sixel_frame_get_pixels() API usage. This can lead to a reliable crash, confirmed by ASAN, and potentially even remote code execution. The fix is available in version 1.8.7-r1.