EUVD-2026-102270Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XBIN file with unterminated RLE record
-
ExploitVictim renders file via libansilove ≤1.4.2
-
ExecutionMissing bounds check triggers out-of-bounds read
-
ImpactApplication crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to render an attacker-supplied, crafted XBIN file (containing a compressed run-length record ending in a control byte such as 0x7F) using an application that links libansilove version ≤1.4.2 and invokes the ansilove_xbin() loader. Limiting factors: the attack vector is local (the malicious file must be delivered to and opened by the victim), passive user interaction is required (the victim must process/render the untrusted art), there is no network-facing path, and the outcome is confined to a crash rather than code execution or data disclosure. |
| Impact | This is a medium-severity denial-of-service issue, not a high-priority emergency. The CVSS 4.0 score of 6.8 is driven entirely by the availability impact (VA:H), while VC:N and VI:N confirm there is no confidentiality or integrity impact - the out-of-bounds read manifests as an application crash, not data theft or code execution. The vector is local (AV:L) with passive user interaction required (UI:P), meaning an attacker cannot reach this remotely; a victim must render an attacker-supplied XBIN file using an application built on libansilove. Publicly available exploit code exists (a hackmd technical writeup and a VulnCheck advisory), which raises reproducibility, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The signals are internally consistent except for the 'Information Disclosure' tag, which conflicts with the CVSS confidentiality metric of VC:N - the authoritative impact is a crash (CWE-125 read leading to DoS), so treat this as a stability/DoS bug in untrusted-file-parsing contexts rather than an info-leak. Net: real and verifiable, but low operational urgency outside workflows that render untrusted ANSI/XBIN art. |
| Exploit ScenarioDerived | An attacker crafts a malicious XBIN art file containing a compressed run-length record that ends in a control byte such as 0x7F, then distributes it (e.g., via a download, attachment, or art repository) to a victim who opens it in a tool using libansilove ≤1.4.2. When the renderer processes the RLE records without bounds checking, it reads past the input buffer and crashes the application. Publicly available exploit/proof-of-concept code exists, making the crash readily reproducible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
An out-of-bounds read in libansilove through 1.4.2 lets a crafted compressed XBIN file, particularly one whose run-length data ends on a control byte such as 0x7F, drive the ansilove_xbin() loader past the end of its input buffer and crash the rendering application. Applications that link libansilove and render untrusted XBIN art are affected; the outcome assessed is denial of service via crash rather than code execution or disclosure of sensitive data. Publicly available exploit code exists in the form of a published proof-of-concept writeup, and exploitation requires a victim to open an attacker-supplied file, making this a local, user-interaction-dependent medium-severity issue rather than a remotely reachable emergency.
RemediationAI
No vendor-released patched version is identified in the available intelligence at the time of analysis, so the primary action is to monitor the upstream repository (https://github.com/ansilove/libansilove) and the VulnCheck advisory for a fixed release and upgrade past 1.4.2 as soon as one is tagged. Until then, the most effective compensating control is to remove the attack path: stop invoking the XBIN loader on untrusted input, either by disabling XBIN format support in the consuming application (accepting loss of XBIN rendering as the trade-off) or by gating it behind a format allow-list that excludes XBIN. Where XBIN support is genuinely required, isolate it - run the conversion in a short-lived, sandboxed child process with CPU and memory limits and seccomp/bubblewrap-style confinement so that the segmentation fault terminates only the disposable worker rather than the host application, which adds process-management complexity and a small latency overhead. Deployments can also add input sanitisation that rejects XBIN files whose compressed stream terminates on a dangling control byte, but such heuristics are brittle and should not be treated as a substitute for the upstream fix. Because the flaw is a memory-safety defect, building the library with AddressSanitizer or a hardened allocator during testing and enabling platform memory-protection features in production can reduce the chance of a benign crash escalating, though these are hardening measures rather than fixes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libansilove is a small C library used to convert legacy ANSI/ASCII scene art formats (ANSI, ASCII, PCB, XBIN, and others) into images such as PNG, GIF, or text output; it underpins viewers and art-pack archival tools. XBIN is a DOS-era art format that stores palette and font data along with character/attribute bytes that may be run-length encoded, where a control byte signals a repeat count for the following record. The vulnerable routine ansilove_xbin() in src/loaders/xbin.c (lines approximately 169-241) walks these compressed run-length records but does not verify that a control byte and its associated run length still lie within the bounds of the input buffer. When a file terminates on such a control byte (for example 0x7F) the decoder dereferences or reads one or more bytes past the end of the allocated input. This is a classic CWE-125 out-of-bounds read rooted in missing length validation during stream decoding. The impact is bounded by the read itself: an in-memory over-read that typically manifests as a segmentation fault, with no demonstrated write primitive, no controlled attacker data flow, and no demonstrated exfiltration path.
Know when Ansilove gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local file must be rendered by the victim (AV:L, UI:R); no privileges needed (PR:N); out-of-bounds read only crashes the app, so C:N/I:N and A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of service in libansilove 1.3.0 through 1.4.2 lets a crafted XBIN file crash any application that parses it: sett
The ansilove_ansi function in loaders/ansi.c in libansilove 1.0.0 allows remote attackers to cause a denial of service (
Exploit-DB