CVE-2026-111143 Details
Description
Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art.
A memory safety vulnerability has been identified in Ansilove libansilove versions through 1.4.2. The issue resides in the XBIN loader function 'ansilove_xbin', located in 'src/loaders/xbin.c'. This vulnerability involves an out-of-bounds read that occurs during the decoding of compressed run-length records. Attackers can exploit this by crafting a compressed XBIN file that ends with a control byte, such as 0x7F, which triggers the vulnerability by causing the application to read beyond the allocated input buffer. This out-of-bounds read can lead to a crash when the application attempts to render untrusted XBIN art.
Users can upgrade to Ansilove libansilove version 1.4.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ansilove libansilove | <= 1.4.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |