Out-of-Bounds Read Vulnerability in Ansilove Product by Ansilove
CVE-2026-111143

6.8MEDIUM

Key Information:

Vendor

Ansilove

Status
Libansilove
Vendor
CVE Published:
15 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-111143?

The libansilove library through version 1.4.2 is susceptible to an out-of-bounds read vulnerability triggered by malformed compressed XBIN files. This flaw occurs within the ansilove_xbin() function due to insufficient bounds checks for compressed run-length encoded records. Attackers can exploit this vulnerability by sending specially crafted XBIN files that contain control bytes, allowing them to read beyond the allocated input buffer and potentially crash applications that utilize the library to render untrusted XBIN artworks.

Affected Version(s)

libansilove 0 <= 1.4.2

References

https://hackmd.io/@haind-pwn/libansilove-xbin-rle-oob-rea...
technical-descriptionexploit
https://github.com/ansilove/libansilove/blob/f1b05447aa56...
technical-description
https://github.com/ansilove/libansilove
product

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.