CVE-2026-111144
Received Received - Intake

NULL Pointer Dereference in libansilove via XBIN File Handling

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description
libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar() to index a NULL high_font_data_xbin pointer and terminate the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-111144
EUVD
EUVD-2026-102271

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ansilove libansilove 1.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libansilove versions 1.3.0 through 1.4.2 have a NULL pointer dereference flaw in the ansilove_xbin() function. Attackers can crash applications by providing a malicious XBIN file that sets the 512-character flag without enabling the custom-font flag. This causes drawchar() to access a NULL high_font_data_xbin pointer, terminating the process.

Detection Guidance

To detect this vulnerability, inspect systems running libansilove versions 1.3.0 through 1.4.2 for crashes when processing XBIN files. Check for NULL pointer dereference errors in logs or core dumps. Use commands like 'strings' on suspicious files to identify crafted XBIN files with the 512-character flag set without the custom-font flag.

Impact Analysis

This vulnerability allows attackers to crash applications processing XBIN files, leading to denial-of-service conditions. If exploited, it could disrupt services relying on libansilove for rendering ANSI or XBIN art, causing application instability or unexpected termination.

Mitigation Strategies

Immediately upgrade libansilove to a patched version beyond 1.4.2. If upgrading is not possible, disable processing of XBIN files or restrict access to the ansilove_xbin() function. Monitor applications for crashes and apply input validation for XBIN files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart