libsixel Use-After-Free: High-Severity Bug in Image Handling

A significant use-after-free vulnerability, tracked as CVE-2026-33021, has been identified in libsixel, an implementation of the SIXEL encoder/decoder. According to the National Vulnerability Database, versions 1.8.7 and earlier are susceptible to this flaw, which stems from how sixel_encoder_encode_bytes() interacts with sixel_frame_init(). The core issue lies in sixel_frame_init() storing a direct pointer to the caller-owned pixel buffer rather than creating a defensive copy.

This becomes problematic when a resize operation occurs. As reported by the National Vulnerability Database, sixel_frame_convert_to_rgb888() then unconditionally frees this original, caller-owned buffer and replaces it with a new internal allocation. This leaves the caller with a dangling pointer, leading to a classic use-after-free scenario if the original buffer is accessed again. AddressSanitizer has confirmed this bug. An attacker capable of controlling incoming frames could repeatedly and predictably trigger this vulnerability, resulting in reliable crashes and, critically, potential for arbitrary code execution. The issue has been addressed in version 1.8.7-r1.