libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin() that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar() to index a NULL highfontdataxbin pointer and terminate the process.

Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilovexbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art.