CVE-2026-33018: 
NixOS vulnerability analysis and mitigation

CVE-2026-33018 is a heap use-after-free vulnerability in libsixel, a SIXEL encoder/decoder library, affecting versions 1.8.7 and prior. The flaw resides in the load_gif() function in fromgif.c, where a single sixel_frame_t object is reused across all frames of an animated GIF and gif_init_frame() unconditionally frees and reallocates frame->pixels between frames without consulting the object's reference count. It was disclosed on April 14, 2026, and fixed in version 1.8.7-r1. The vulnerability carries a CVSS v3.1 base score of 7.0 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference). The public API provides sixel_frame_ref() to retain a frame and sixel_frame_get_pixels() to access the raw pixel buffer — a documented and reasonable usage pattern. However, when gif_init_frame() processes the second frame, it frees frame->pixels at fromgif.c:212 and reallocates it at fromgif.c:214 without ever checking frame->ref, leaving any externally saved pixel pointer dangling. An attacker must supply a crafted animated GIF with at least two palettized frames to an application that uses sixel_helper_load_image_file() with a multi-frame callback that follows the documented retain-and-access pattern; user interaction (opening the malicious file) is required. The vulnerability was confirmed via AddressSanitizer (ASAN) and a complete proof-of-concept harness is publicly available (GitHub Advisory).

Successful exploitation results in a heap use-after-free condition that guarantees at minimum a reliable application crash (denial of service) and potentially arbitrary code execution with the privileges of the application processing the GIF. Confidentiality, integrity, and availability are all rated High in the CVSS scoring. Any application that processes user-supplied animated GIF files via sixel_helper_load_image_file() with a multi-frame callback is within scope, and exploitation could enable an attacker to pivot further depending on the privileges of the affected process (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit (a complete C harness program, harness.c, paired with a trigger file poc_uaf_pixel.gif) is publicly available in the GitHub Security Advisory. The PoC demonstrates the use-after-free by retaining a frame reference, saving the pixel pointer, and reading the dangling pointer on the second frame. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.015% (0.000150), indicating low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Craft a malicious GIF: Create or obtain an animated GIF file with at least two palettized frames (poc_uaf_pixel.gif). Any standard animated GIF with multiple frames can serve as a trigger.
2. Identify a vulnerable target application: Find an application that uses libsixel ≤ 1.8.7 and calls sixel_helper_load_image_file() with a multi-frame callback that retains frame references via sixel_frame_ref() and accesses pixel data via sixel_frame_get_pixels().
3. Deliver the malicious GIF: Supply the crafted animated GIF to the target application through any available input channel (file upload, email attachment, shared directory, etc.) that triggers GIF processing.
4. Trigger the use-after-free: When the application processes the second frame, gif_init_frame() frees and reallocates frame->pixels without checking the reference count, leaving the pointer saved from the first frame's callback dangling.
5. Achieve crash or code execution: Reading the dangling pointer causes a heap use-after-free. With heap layout control (e.g., via heap grooming techniques), an attacker may redirect execution to attacker-controlled data, achieving arbitrary code execution with the privileges of the vulnerable application (GitHub Advisory).

• Process: Application crash or unexpected termination when processing animated GIF files; ASAN reports of READ of freed memory originating from on_frame/load_gif/gif_init_frame call stacks.
• Logs: Application error logs showing segmentation faults or heap corruption errors during GIF image loading; crash dumps referencing fromgif.c, loader.c, or sixel_helper_load_image_file.
• File System: Presence of suspicious animated GIF files (e.g., minimal two-frame GIFs) in upload directories or temporary processing folders; core dump files generated by the affected application.
• Network: Unexpected inbound delivery of small animated GIF files to services that process images with libsixel, particularly files with minimal frame content inconsistent with legitimate use (GitHub Advisory).

Upgrade libsixel to version 1.8.7-r1, which contains the security fix for CVE-2026-33018 along with patches for several other CVEs reported by the same researcher. Until patching is complete, restrict or disable the ability of applications to process untrusted animated GIF files, and audit all applications using sixel_helper_load_image_file() with multi-frame callbacks to assess exposure. No configuration-based workaround that fully mitigates the vulnerability without code changes has been identified (GitHub Release, Red Hat Bugzilla).

The vulnerability was reported by security researcher nicoppida, who also discovered several other CVEs in libsixel fixed in the same release (CVE-2026-33019, CVE-2026-33020, CVE-2026-33021, CVE-2026-33023). Red Hat tracked the issue via their security response process and Bugzilla. No significant broader media coverage or notable social media discussion beyond standard CVE aggregator activity has been observed (GitHub Release, Red Hat Bugzilla).