Skip to main content

libcaca CVE-2026-42046

| EUVDEUVD-2026-29326 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-05-11 GitHub_M
RCE Buffer Overflow Heap Overflow Libcaca
7.8
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local file must be opened by the victim so AV:L and UI:R with no privileges (PR:N); heap corruption enabling code execution justifies high C/I/A.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 23, 2026 - 23:30 vuln.today
Analysis Generated
Jul 23, 2026 - 23:30 vuln.today
CVE Published
May 11, 2026 - 21:23 nvd
HIGH 7.8

DescriptionGitHub Advisory

libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write (heap overflow) by supplying a crafted file in the "caca" format. Depending on the build configuration and memory allocator, this may lead to memory corruption or remote code execution. This is the same vulnerability as CVE-2021-3410 but the fix at that time was not fully correct. Commit fb77acff9ba6bb01d53940da34fb10f20b156a23 fixes this vulnerability.

AnalysisAI

Heap out-of-bounds write in libcaca 0.99.beta20 and earlier lets an attacker corrupt memory when a victim opens a maliciously crafted file in libcaca's native "caca" canvas format. An integer overflow in the canvas import/resize path (width * height) produces an undersized allocation followed by a controlled heap overflow, potentially enabling remote code execution depending on the build and allocator. This is a regression of CVE-2021-3410, whose original fix was incomplete; SSVC classifies exploitation as proof-of-concept with total technical impact, and EPSS is low at 0.06% - no public exploit identified at time of analysis and not on CISA KEV.

Technical ContextAI

libcaca (Colour AsCii Art library) renders graphics as ASCII/ANSI art and is embedded in media tooling and image viewers (e.g. mplayer/MPlayer, ImageMagick coders, and various terminal-graphics utilities) via its caca_import_* canvas functions. The root cause is CWE-122 (heap-based buffer overflow) driven by an integer overflow: in caca/canvas.c, caca_resize() computed new_size = width * height using signed int arithmetic and validated it with a check (new_size < 0 || new_size / width != height) that does not reliably catch overflow for attacker-controlled dimensions embedded in the caca file header. The patch (commit fb77acff) includes <limits.h> and replaces the flawed check with an overflow-safe guard (width != 0 && height > INT_MAX / width) evaluated before the multiplication, so an oversized geometry is rejected rather than wrapping to a small allocation that is then overflowed during import. The affected component is the CPE cpe:2.3:a:cacalabs:libcaca across all versions up to and including 0.99.beta20.

RemediationAI

Upstream fix available (commit fb77acff9ba6bb01d53940da34fb10f20b156a23); a released, tagged patched version is not independently confirmed from the provided data, so update to a distribution package or build that explicitly incorporates that commit - track the vendor advisory at https://github.com/cacalabs/libcaca/security/advisories/GHSA-4vvg-vrqv-m56w for the fixed release, and rebuild/redeploy any application statically or dynamically linking libcaca. Until a patched build is deployed, do not open caca-format files from untrusted sources and restrict applications from auto-processing untrusted caca canvases (the trade-off is loss of that import feature); where feasible, sandbox or run libcaca-consuming tools under seccomp/AppArmor and with a hardened allocator to raise the cost of heap corruption (this mitigates but does not eliminate the bug). Since libcaca is usually a transitive dependency, audit downstream software (media players, image converters) and update via your distribution's package manager once the fixed version lands.

More in Libcaca

View all
CVE-2018-20549 HIGH POC
8.8 Dec 28

There is an illegal WRITE memory access at caca/file.c (function caca_file_read) in libcaca 0.99.beta19. Rated high seve
CVE-2018-20548 HIGH POC
8.8 Dec 28

There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 1bpp data. Ra
CVE-2018-20545 HIGH POC
8.8 Dec 28

There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 4bpp data. Ra
CVE-2018-20547 HIGH POC
8.1 Dec 28

There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for 24bpp dat
CVE-2018-20546 HIGH POC
8.1 Dec 28

There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for the defau
CVE-2021-30499 HIGH POC
7.8 May 27

A flaw was found in libcaca. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attac
CVE-2021-30498 HIGH POC
7.8 May 26

A flaw was found in libcaca. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attac
CVE-2021-3410 HIGH POC
7.8 Feb 23

A flaw was found in libcaca v0.99.beta19. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. P
CVE-2022-0856 MEDIUM POC
6.5 Mar 10

libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Ser
CVE-2018-20544 MEDIUM POC
6.5 Dec 28

There is floating point exception at caca/dither.c (function caca_dither_bitmap) in libcaca 0.99.beta19. Rated medium se

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2026-42046 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy