CVE-2026-111143: Ansilove libansilove through 1.4.2 Out-of-Bounds Read via ansilove_xbin RLE Decoding
Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilovexbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using libansilove through 1.4.2 to render untrusted, compressed XBIN art are exposed. The reported impact is an application crash caused by reading beyond the supplied input buffer.
What does an attacker need to trigger the vulnerability?
An attacker needs to cause the application to process a crafted compressed XBIN file. A malformed file ending in a control byte such as 0x7F can trigger the out-of-bounds read during RLE decoding.
Is user interaction required?
Yes. The supplied CVSS vector includes UI:R, indicating that a user must interact with the crafted XBIN content, such as by opening or rendering it in an affected application.