CVE-2026-11623

Public on 2026-06-09
Modified on 2026-06-12
Description
A security vulnerability has been detected in tmux up to 3.6a. Affected is the function image_free of the file image.c. Such manipulation leads to use after free. Local access is required to approach this attack. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 3.7-rc is able to address this issue. The name of the patch is fc6d94a9f8a593bd8b7031650802084385d4ee03. The affected component should be upgraded.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
5.8
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core tmux Not Affected
Amazon Linux 2023 tmux Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 5.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H