Vulnerability-Lookup

CVE-2026-33021 (GCVE-0-2026-33021)

Vulnerability from cvelistv5 – Published: 2026-04-14 21:57 – Updated: 2026-04-16 13:54

Title

libsixel: Use-after-free in sixel_encoder_encode_bytes()

Summary

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame->pixels without making a defensive copy. When a resize operation is triggered, sixel_frame_convert_to_rgb888() unconditionally frees this caller-owned buffer and replaces it with a new internal allocation, leaving the caller with a dangling pointer. Any subsequent access to the original buffer by the caller constitutes a use-after-free, confirmed by AddressSanitizer. An attacker who controls incoming frames can trigger this bug repeatedly and predictably, resulting in a reliable crash with potential for code execution. This issue has been fixed in version 1.8.7-r1.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use After Free

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/saitoha/libsixel/security/advi…	x_refsource_CONFIRM
https://github.com/saitoha/libsixel/releases/tag/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
saitoha	libsixel	Affected: < 1.8.7-r1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33021",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-16T13:54:16.495174Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T13:54:36.177Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libsixel",
          "vendor": "saitoha",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.7-r1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya\u0027s sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame-\u003epixels without making a defensive copy. When a resize operation is triggered, sixel_frame_convert_to_rgb888() unconditionally frees this caller-owned buffer and replaces it with a new internal allocation, leaving the caller with a dangling pointer. Any subsequent access to the original buffer by the caller constitutes a use-after-free, confirmed by AddressSanitizer. An attacker who controls incoming frames can trigger this bug repeatedly and predictably, resulting in a reliable crash with potential for code execution. This issue has been fixed in version 1.8.7-r1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-14T21:57:22.817Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/saitoha/libsixel/security/advisories/GHSA-j6m5-2cc7-3whc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-j6m5-2cc7-3whc"
        },
        {
          "name": "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1"
        }
      ],
      "source": {
        "advisory": "GHSA-j6m5-2cc7-3whc",
        "discovery": "UNKNOWN"
      },
      "title": "libsixel: Use-after-free in sixel_encoder_encode_bytes()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33021",
    "datePublished": "2026-04-14T21:57:22.817Z",
    "dateReserved": "2026-03-17T17:22:14.667Z",
    "dateUpdated": "2026-04-16T13:54:36.177Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33021",
      "date": "2026-07-31",
      "epss": "0.00247",
      "percentile": "0.16134"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33021\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-14T23:16:27.660\",\"lastModified\":\"2026-07-25T11:10:00.100\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"libsixel is a SIXEL encoder/decoder implementation derived from kmiya\u0027s sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame-\u003epixels without making a defensive copy. When a resize operation is triggered, sixel_frame_convert_to_rgb888() unconditionally frees this caller-owned buffer and replaces it with a new internal allocation, leaving the caller with a dangling pointer. Any subsequent access to the original buffer by the caller constitutes a use-after-free, confirmed by AddressSanitizer. An attacker who controls incoming frames can trigger this bug repeatedly and predictably, resulting in a reliable crash with potential for code execution. This issue has been fixed in version 1.8.7-r1.\"},{\"lang\":\"es\",\"value\":\"libsixel es una implementaci\u00f3n de codificador/decodificador SIXEL derivada de sixel de kmiya. Las versiones 1.8.7 y anteriores contienen una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n en sixel_encoder_encode_bytes() porque sixel_frame_init() almacena el puntero del b\u00fafer de p\u00edxeles propiedad del llamador directamente en frame  -\u003e  pixels sin hacer una copia defensiva. Cuando se activa una operaci\u00f3n de redimensionamiento, sixel_frame_convert_to_rgb888() libera incondicionalmente este b\u00fafer propiedad del llamador y lo reemplaza con una nueva asignaci\u00f3n interna, dejando al llamador con un puntero colgante. Cualquier acceso posterior al b\u00fafer original por parte del llamador constituye un uso despu\u00e9s de liberaci\u00f3n, confirmado por AddressSanitizer. Un atacante que controla los fotogramas entrantes puede activar este error de forma repetida y predecible, lo que resulta en un fallo fiable con potencial para la ejecuci\u00f3n de c\u00f3digo. Este problema ha sido solucionado en la versi\u00f3n 1.8.7-r1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"saitoha\",\"product\":\"libsixel\",\"versions\":[{\"version\":\"\u003c 1.8.7-r1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":4.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-16T13:54:16.495174Z\",\"id\":\"CVE-2026-33021\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.8.7-r1\",\"matchCriteriaId\":\"E16EAA6A-544F-4D16-829D-1B7C9979EA6A\"}]}]}],\"references\":[{\"url\":\"https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/saitoha/libsixel/security/advisories/GHSA-j6m5-2cc7-3whc\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-28T07:29:50+00:00",
      "cve": "CVE-2026-33021",
      "id": "CVE-2026-33021",
      "initial_release_date": "2026-04-14T21:57:22.817000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "libsixel: libsixel: Use-after-free vulnerability allows for potential code execution via premature pixel buffer freeing.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33021.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-04-15T13:41:20Z",
      "cve": "CVE-2026-33021",
      "id": "CVE-2026-33021",
      "initial_release_date": "2026-04-15T13:41:20Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-33021",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-33021.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"libsixel: Use-after-free in sixel_encoder_encode_bytes()\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-416\", \"lang\": \"en\", \"description\": \"CWE-416: Use After Free\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"LOCAL\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/saitoha/libsixel/security/advisories/GHSA-j6m5-2cc7-3whc\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/saitoha/libsixel/security/advisories/GHSA-j6m5-2cc7-3whc\"}, {\"name\": \"https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1\"}], \"affected\": [{\"vendor\": \"saitoha\", \"product\": \"libsixel\", \"versions\": [{\"version\": \"\u003c 1.8.7-r1\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-14T21:57:22.817Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"libsixel is a SIXEL encoder/decoder implementation derived from kmiya\u0027s sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame-\u003epixels without making a defensive copy. When a resize operation is triggered, sixel_frame_convert_to_rgb888() unconditionally frees this caller-owned buffer and replaces it with a new internal allocation, leaving the caller with a dangling pointer. Any subsequent access to the original buffer by the caller constitutes a use-after-free, confirmed by AddressSanitizer. An attacker who controls incoming frames can trigger this bug repeatedly and predictably, resulting in a reliable crash with potential for code execution. This issue has been fixed in version 1.8.7-r1.\"}], \"source\": {\"advisory\": \"GHSA-j6m5-2cc7-3whc\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33021\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-16T13:54:16.495174Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-16T13:54:28.675Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33021\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-03-17T17:22:14.667Z\", \"datePublished\": \"2026-04-14T21:57:22.817Z\", \"dateUpdated\": \"2026-04-16T13:54:36.177Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-33021

Vulnerability from fkie_nvd - Published: 2026-04-14 23:16 - Updated: 2026-06-17 10:36

Severity

7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1	Release Notes
	security-advisories@github.com	https://github.com/saitoha/libsixel/security/advisories/GHSA-j6m5-2cc7-3whc	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	saitoha	libsixel	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "libsixel",
          "vendor": "saitoha",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.7-r1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:saitoha:libsixel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E16EAA6A-544F-4D16-829D-1B7C9979EA6A",
              "versionEndExcluding": "1.8.7-r1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya\u0027s sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame-\u003epixels without making a defensive copy. When a resize operation is triggered, sixel_frame_convert_to_rgb888() unconditionally frees this caller-owned buffer and replaces it with a new internal allocation, leaving the caller with a dangling pointer. Any subsequent access to the original buffer by the caller constitutes a use-after-free, confirmed by AddressSanitizer. An attacker who controls incoming frames can trigger this bug repeatedly and predictably, resulting in a reliable crash with potential for code execution. This issue has been fixed in version 1.8.7-r1."
    }
  ],
  "id": "CVE-2026-33021",
  "lastModified": "2026-06-17T10:36:47.673",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33021",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-16T13:54:16.495174Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-14T23:16:27.660",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-j6m5-2cc7-3whc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

ubuntu-cve-2026-33021

Vulnerability from osv_ubuntu

Published

2026-04-14 23:16

Modified

2026-05-20 15:27

Summary

Details

Severity

7.3 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-33021	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-33021	REPORT
	https://github.com/saitoha/libsixel/security/advi…	REPORT
	https://github.com/saitoha/libsixel/releases/tag/…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libsixel-bin",
            "binary_version": "1.5.2-2"
          },
          {
            "binary_name": "libsixel1",
            "binary_version": "1.5.2-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libsixel",
        "purl": "pkg:deb/ubuntu/libsixel@1.5.2-2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.2-1",
        "1.5.2-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libsixel-bin",
            "binary_version": "1.7.3-1"
          },
          {
            "binary_name": "libsixel-examples",
            "binary_version": "1.7.3-1"
          },
          {
            "binary_name": "libsixel1",
            "binary_version": "1.7.3-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libsixel",
        "purl": "pkg:deb/ubuntu/libsixel@1.7.3-1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.2-2",
        "1.7.3-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libsixel-bin",
            "binary_version": "1.8.2-2.1"
          },
          {
            "binary_name": "libsixel-examples",
            "binary_version": "1.8.2-2.1"
          },
          {
            "binary_name": "libsixel1",
            "binary_version": "1.8.2-2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libsixel",
        "purl": "pkg:deb/ubuntu/libsixel@1.8.2-2.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.2-1",
        "1.8.2-2.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libsixel-bin",
            "binary_version": "1.10.3-3"
          },
          {
            "binary_name": "libsixel-examples",
            "binary_version": "1.10.3-3"
          },
          {
            "binary_name": "libsixel1",
            "binary_version": "1.10.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libsixel",
        "purl": "pkg:deb/ubuntu/libsixel@1.10.3-3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.6-2",
        "1.10.3-2",
        "1.10.3-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libsixel-bin",
            "binary_version": "1.10.3-3build1"
          },
          {
            "binary_name": "libsixel-examples",
            "binary_version": "1.10.3-3build1"
          },
          {
            "binary_name": "libsixel1",
            "binary_version": "1.10.3-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "libsixel",
        "purl": "pkg:deb/ubuntu/libsixel@1.10.3-3build1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.3-3",
        "1.10.3-3build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libsixel-bin",
            "binary_version": "1.10.5-1"
          },
          {
            "binary_name": "libsixel-examples",
            "binary_version": "1.10.5-1"
          },
          {
            "binary_name": "libsixel1",
            "binary_version": "1.10.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "libsixel",
        "purl": "pkg:deb/ubuntu/libsixel@1.10.5-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.5-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libsixel-bin",
            "binary_version": "1.10.5-1build1"
          },
          {
            "binary_name": "libsixel-examples",
            "binary_version": "1.10.5-1build1"
          },
          {
            "binary_name": "libsixel1",
            "binary_version": "1.10.5-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libsixel",
        "purl": "pkg:deb/ubuntu/libsixel@1.10.5-1build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.5-1",
        "1.10.5-1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "libsixel is a SIXEL encoder/decoder implementation derived from kmiya\u0027s sixel. Versions 1.8.7 and prior contain a use-after-free vulnerability in sixel_encoder_encode_bytes() because sixel_frame_init() stores the caller-owned pixel buffer pointer directly in frame-\u003epixels without making a defensive copy. When a resize operation is triggered, sixel_frame_convert_to_rgb888() unconditionally frees this caller-owned buffer and replaces it with a new internal allocation, leaving the caller with a dangling pointer. Any subsequent access to the original buffer by the caller constitutes a use-after-free, confirmed by AddressSanitizer. An attacker who controls incoming frames can trigger this bug repeatedly and predictably, resulting in a reliable crash with potential for code execution. This issue has been fixed in version 1.8.7-r1.",
  "id": "UBUNTU-CVE-2026-33021",
  "modified": "2026-05-20T15:27:21Z",
  "published": "2026-04-14T23:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-33021"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33021"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/saitoha/libsixel/security/advisories/GHSA-j6m5-2cc7-3whc"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-33021"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-33021 (GCVE-0-2026-33021)

FKIE_CVE-2026-33021

ubuntu-cve-2026-33021

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature