PatchSiren

tmux CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW tmux CVE published 2026-06-09

CVE-2026-11623

CVE-2026-11623 is a use after free vulnerability in tmux up to 3.6a. The vulnerability is located in the image_free function of image.c and requires local access with high complexity to exploit. The vulnerability has a CVSS score of 1.1 and is considered low severity. The exploit has been publicly disclosed and can be used. Upgrading to version 3.7-rc addresses this issue with the patch fc6d94a9f8a593bd8b [truncated]