CVE-2026-11623: tmux Use After Free Vulnerability

CVE-2026-11623 Overview

CVE-2026-11623 is a use-after-free vulnerability [CWE-119] in the terminal multiplexer tmux, affecting versions up to and including 3.6a. The flaw resides in the image_free function within image.c, where the routine removes an image from a screen's image list without tracking which list the image actually belongs to. Exploitation requires local access and is rated as high complexity with difficult exploitability. The issue is resolved in tmux 3.7-rc through commit fc6d94a9f8a593bd8b7031650802084385d4ee03.

Critical Impact
A local attacker with low privileges can trigger memory corruption in tmux, potentially leading to limited confidentiality, integrity, and availability impact on the affected process.

Affected Products

tmux versions up to and including 3.6a
Linux and Unix systems running vulnerable tmux builds with SIXEL image support enabled
Downstream distributions packaging tmux <= 3.6a

Discovery Timeline

2026-06-09 - CVE-2026-11623 published to NVD
2026-06-09 - Last updated in NVD database
Patch commit - fc6d94a9f8a593bd8b7031650802084385d4ee03 merged in tmux 3.7-rc

Technical Details for CVE-2026-11623

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-119] in tmux's image handling subsystem, which is part of the SIXEL graphics support. tmux maintains two lists for images: the active images list on a screen and a saved_images list used when switching to alternate screen buffers. The image_free function unconditionally removed each image from the screen's primary images list, even when the image was actually stored on the saved_images list. This list desynchronization corrupts the queue and leaves dangling references, producing a use-after-free condition when subsequent operations dereference image entries.

The exploit has been publicly disclosed, but the attack complexity is high and requires local access with low privileges. No interaction from another user is required to attempt exploitation.

Root Cause

The root cause is missing list-tracking metadata in the struct image object. Prior to the patch, image_free assumed every image was attached to im->s->images, but screen_alternate_on and related routines move images onto a separate saved_images list. Removing an image from the wrong queue with TAILQ_REMOVE corrupts internal queue pointers and frees memory still referenced through the other list.

Attack Vector

Exploitation requires a local user able to drive a tmux session capable of receiving SIXEL image escape sequences. By manipulating image creation, alternate-screen transitions, and image destruction, an attacker forces image_free to operate on a corrupted list state. The result is memory corruption within the tmux process, which runs with the privileges of the invoking user.

// Patch fix in image.c - tracks which list each image belongs to
 static void
 image_free(struct image *im)
 {
-	struct screen	*s = im->s;
-
 	image_log(im, __func__, NULL);
 
 	TAILQ_REMOVE(&all_images, im, all_entry);
 	all_images_count--;
 
-	TAILQ_REMOVE(&s->images, im, entry);
+	TAILQ_REMOVE(im->list, im, entry);
 	sixel_free(im->data);
 	free(im->fallback);
 	free(im);
// Source: https://github.com/tmux/tmux/commit/fc6d94a9f8a593bd8b7031650802084385d4ee03

The fix replaces the hardcoded &s->images reference with im->list, a per-image pointer that records the actual list each image belongs to. A companion change in screen.c updates screen_alternate_on to manage the saved_images list correctly under ENABLE_SIXEL.

Detection Methods for CVE-2026-11623

Indicators of Compromise

Unexpected tmux process crashes or SIGSEGV signals captured in system logs or core dump directories
Presence of tmux binaries with reported version <= 3.6a on hosts with multi-user or shared shell access
Local shell sessions injecting unusual SIXEL escape sequences into tmux panes

Detection Strategies

Inventory installed tmux versions across endpoints and flag any host running tmux -V output of 3.6a or earlier
Monitor process telemetry for repeated tmux crashes followed by user-spawned debugging or exploitation tools
Audit shared developer and jump hosts where multiple users attach to the same tmux server socket

Monitoring Recommendations

Forward auditd, journald, and core dump events for tmux to a centralized log platform for correlation
Alert on local privilege transitions that follow tmux abnormal terminations on the same host
Track package manager events that install or downgrade tmux to vulnerable versions

How to Mitigate CVE-2026-11623

Immediate Actions Required

Upgrade tmux to version 3.7-rc or any later release containing commit fc6d94a9f8a593bd8b7031650802084385d4ee03
Identify shared hosts where untrusted local users have shell access and prioritize patching those systems first
Restart all running tmux servers after upgrading so that long-lived sessions load the patched binary

Patch Information

The issue is fixed by the upstream commit tmux commit fc6d94a9, first available in the tmux 3.7-rc release. Distribution maintainers should backport this commit to any packaged tmux build of 3.6a or earlier. Additional vulnerability details are tracked in the VulDB CVE-2026-11623 entry.

Workarounds

Build tmux without SIXEL support by omitting the ENABLE_SIXEL compile-time flag if image handling is not required
Restrict local access to multi-user systems and enforce per-user tmux sockets to limit cross-user exposure
Avoid forwarding untrusted terminal output streams into tmux panes until the patched version is deployed

bash

# Verify tmux version and update on Debian/Ubuntu-based systems
tmux -V
sudo apt update && sudo apt install --only-upgrade tmux

# Build patched tmux from source
git clone https://github.com/tmux/tmux.git
cd tmux
git checkout 3.7-rc
sh autogen.sh && ./configure && make && sudo make install

# Kill running tmux servers so users reattach to the patched binary
tmux kill-server