libcaca EUVD-2026-29326

Exploitation requires the victim to open or import an attacker-supplied file in libcaca's native "caca" canvas format through an application that uses libcaca's canvas import functionality; the malicious file must carry crafted width/height fields that overflow the signed-int size calculation in caca_resize(). Limiting factors: the CVSS vector is AV:L with UI:R, so this is not remotely triggerable without user interaction - the attacker cannot exploit a default network service, they must get a victim to process the file locally. Reliability of achieving code execution (versus a crash) further depends on build configuration and the heap allocator in use, as stated in the description, so successful RCE is not guaranteed across all deployments.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8, High) is internally consistent with a file-parsing bug: local attack vector, no privileges required, but mandatory user interaction (the victim must open a crafted caca file), yielding high confidentiality, integrity, and availability impact. Signals are aligned rather than conflicting: EPSS is low (0.06%, 20th percentile) and SSVC marks Exploitation as only "poc" and Automatable "no", which fits a client-side format-parsing vulnerability that requires social engineering and is not mass-scannable - so despite a High CVSS and "total" technical impact, real-world urgency is moderate, not critical. The main uplift is that a working proof-of-concept context exists (SSVC poc) and this is a known-incomplete-fix regression of CVE-2021-3410, meaning the code path is well-understood by researchers. There is no evidence of active exploitation (not in KEV), so this is a patch-on-normal-cycle item for most, prioritized higher where libcaca processes untrusted files automatically.

An attacker crafts a malicious file in libcaca's "caca" canvas format with header dimensions chosen so width * height overflows a signed int, then delivers it via email, download, or a web page and lures a victim into opening it with a libcaca-backed viewer or media tool. On import, libcaca allocates an undersized heap buffer and then writes canvas data past its bounds, corrupting adjacent heap metadata; with a favorable allocator layout this can be steered toward code execution. Only proof-of-concept exploitation is reported (SSVC: poc) and no weaponized public exploit is identified at time of analysis.