What is the CVSS score of EUVD-2026-22740?

EUVD-2026-22740 has a contested CVSS base score of 7.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Libsixel are affected by EUVD-2026-22740?

libsixel versions 1.8.7 and earlier contain a heap use-after-free vulnerability that allows local attackers to execute arbitrary code by processing specially crafted animated GIF files.. A patch is available.

How to fix or mitigate EUVD-2026-22740?

Within 24 hours: Identify all systems running libsixel 1.8.7 or earlier using software inventory tools. Within 7 days: Upgrade libsixel to version 1.8.7-r1 or later across all affected systems and dependent applications. Within 30 days: Conduct application testing to verify compatibility with the patched version and validate that image processing functionality operates as expected.

Libsixel EUVD-2026-22740

| CVE-2026-33018 HIGH

Use After Free (CWE-416)

2026-04-14 security-advisories@github.com

Use After Free RCE Memory Corruption Libsixel

High

Disputed · 7.0 NVD

Severity by source

Sources disagree (Low–High)

GitHub Advisory PRIMARY

7.0 HIGH

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

3.1 LOW

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 23, 2026 - 14:48 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:56 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8.7-rc1

Analysis Generated

Apr 14, 2026 - 22:40 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 22:22 euvd

EUVD-2026-22740

Analysis Generated

Apr 14, 2026 - 22:22 vuln.today

CVE Published

Apr 14, 2026 - 22:16 nvd

HIGH 7.0

DescriptionGitHub Advisory

libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a Use-After-Free vulnerability via the load_gif() function in fromgif.c, where a single sixel_frame_t object is reused across all frames of an animated GIF and gif_init_frame() unconditionally frees and reallocates frame->pixels between frames without consulting the object's reference count. Because the public API explicitly provides sixel_frame_ref() to retain a frame and sixel_frame_get_pixels() to access the raw pixel buffer, a callback following this documented usage pattern will hold a dangling pointer after the second frame is decoded, resulting in a heap use-after-free confirmed by ASAN. Any application using sixel_helper_load_image_file() with a multi-frame callback to process user-supplied animated GIFs is affected, with a reliable crash as the minimum impact and potential for code execution. This issue has been fixed in version 1.8.7-r1.

AnalysisAI

Heap use-after-free in libsixel 1.8.7 and earlier allows local code execution when processing malicious animated GIF files through the sixel_helper_load_image_file() API with multi-frame callbacks. The vulnerability triggers when gif_init_frame() unconditionally frees and reallocates frame->pixels between frames while client code retains references via the documented sixel_frame_ref() API, creating dangling pointers confirmed by AddressSanitizer. Fixed in version 1.8.7-r1. No public exploit iden

Technical ContextAI

This is a classic use-after-free vulnerability (CWE-416) in libsixel's GIF decoding pipeline, specifically in the load_gif() function within fromgif.c. The core issue stems from an object lifetime management flaw: the library reuses a single sixel_frame_t object across all frames of an animated GIF, but gif_init_frame() unconditionally calls free() and realloc() on the frame->pixels buffer between frames without checking reference counts. The public API explicitly provides sixel_frame_ref() to increment reference counts and sixel_frame_get_pixels() to access the raw pixel buffer, establishing a documented usage pattern where client code legitimately retains frame references across callbacks. When the second frame is decoded, the unconditional deallocation invalidates all previously-returned pixel buffer pointers, creating a dangling pointer condition. Applications using sixel_helper_load_image_file() with multi-frame callbacks follow this pattern and will dereference freed heap memory, producing ASAN-confirmed heap corruption. The vulnerability represents a fundamental violation of object ownership semantics in a C library with manual memory management.

RemediationAI

Upgrade immediately to libsixel version 1.8.7-r1 or later, which contains the complete fix for this use-after-free vulnerability as confirmed in the release notes at https://github.com/saitoha/libsixel/releases/tag/v1.8.7-r1. Organizations should inventory all applications that depend on libsixel either directly or through transitive dependencies and prioritize updates for systems that process untrusted GIF files from external sources. If immediate patching is not feasible, implement defense-in-depth controls including input validation to reject animated GIFs if only static images are required, sandboxing of image processing operations using operating system primitives like seccomp or pledge, and application of memory-safety mitigations such as heap hardening features available in modern allocators. For development teams building applications on libsixel, avoid using multi-frame callbacks with sixel_helper_load_image_file() until upgrade is complete, or implement custom GIF parsing that does not rely on the vulnerable frame reuse pattern. Consult the GitHub Security Advisory at https://github.com/saitoha/libsixel/security/advisories/GHSA-w46f-jr9f-rgvp for additional vendor guidance and workaround recommendations.