libansilove CVE-2026-111144

Exploitation requires an application built on libansilove 1.3.0-1.4.2 to parse an attacker-supplied XBIN file in which the 512-character flag is set while the custom-font (palette/font) flag is NOT set; this specific combination leaves high_font_data_xbin NULL, and drawchar() then dereferences it. Limiting factors: the vector is local/file-based (AV:L) and requires the target application or user to actually process the malicious file (UI:P) - there is no self-propagating or unauthenticated-network path from the library itself. Impact is confined to a crash of the consuming process (availability only); it does not yield code execution, data disclosure, or data modification. Real-world exposure therefore depends on whether the embedding application accepts untrusted XBIN input (e.g. an automated art-conversion or upload-rendering service).

This is a denial-of-service-only flaw whose real-world priority is modest despite a mid-range 6.8 CVSS 4.0 score. The vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) shows the sole impact is availability (VA:H) - a process crash via NULL pointer dereference (CWE-476) - with no confidentiality or integrity consequence (VC:N/VI:N). The attack is local (AV:L) and requires passive user interaction (UI:P), meaning a victim application must be fed an attacker-crafted XBIN file; it cannot be triggered unauthenticated over the network by itself. Public exploit code exists (referenced VulnCheck advisory and hackmd write-up), which raises reproducibility, but this is NOT confirmed active exploitation - the CVE is not listed in CISA KEV and no EPSS score was provided in the input, so widespread opportunistic abuse is unsubstantiated. Signals are internally consistent: low-complexity crash, POC available, but bounded to a crash rather than RCE. Net: a legitimate bug to patch, but not an emergency - priority is driven by how the embedding application exposes XBIN parsing (e.g. an automated rendering service processing untrusted uploads) rather than by the library flaw in isolation.

An attacker crafts a malicious XBIN file with the 512-character flag set but the custom-font flag cleared, then delivers it to a service or user that renders it with libansilove (e.g. an ANSI-art rendering pipeline or upload processor). When ansilove_xbin() parses the file, drawchar() indexes a NULL high_font_data_xbin pointer and the process terminates, causing a denial of service. A public proof-of-concept and technical write-up are available, lowering the barrier to reproduction.