CVE-2026-111143: Out-of-bounds Read in ansilove libansilove

The vulnerability CVE-2026-111143 affects libansilove versions up to 1.4.2. It is an out-of-bounds read in the ansilove_xbin() function located in src/loaders/xbin.c. The flaw arises due to missing bounds checks for compressed run-length records in XBIN files. An attacker can exploit this by supplying a specially crafted compressed XBIN file that ends with a control byte such as 0x7F, causing the application to read beyond the allocated input buffer. This results in a crash of applications that render untrusted XBIN art.

The vulnerability allows an attacker to cause a denial of service by crashing applications that process maliciously crafted XBIN files. There is no indication of code execution or data corruption beyond the out-of-bounds read and crash. The CVSS 4.0 score is 6.8 (medium severity), reflecting the local attack vector, no privileges required, user interaction needed, and high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or unauthenticated XBIN files with libansilove versions up to 1.4.2 to prevent crashes.