Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111143— Ansilove libansilove through 1.4.2 Out-of-Bounds Read via ansilove_xbin RLE Decoding

Quick assessment

Affected
ansilove libansilove
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ansilove libansilove 在 1.4.2 及之前版本中存在一个越界读取漏洞，该漏洞位于 src/loaders/xbin.c 文件中的 ansilove_xbin() 函数。此漏洞由于缺乏对压缩游程编码记录（compressed run-length records）的边界检查，攻击者可以构造一个以控制字节（例如 0x7F）结尾的恶意 XBIN 文件，从而读取超出输入缓冲区的数据，导致渲染不受信任的 XBIN 图像的應用程式崩溃。

CVSS 5.5 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
ansilove libansilove ≤ 1.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111143

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ansilove libansilove through 1.4.2 Out-of-Bounds Read via ansilove_xbin RLE Decoding
Source: CVE Program / CVE List V5
Vulnerability Description
Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ansilove libansilove 0 ~ 1.4.2 -

II. Public POCs for CVE-2026-111143

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111143

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-111143 (1)

Proof of Concept for CVE-2026-111143 (1)

Other References for CVE-2026-111143 (2)

IV. Related Vulnerabilities

Same product: libansilove
Same vendor: ansilove
Same weakness: CWE-125

V. Comments for CVE-2026-111143

No comments yet

Leave a comment